I assume this scenario is for the case of dynamic templates with initial content set up, which should be filled only by the editor but not structurally/changed adapted other than not using some of the initial content, am I right?
Otherwise, I'd wonder about the actual use case validity, and if maybe policies are a better solution.
Still, it is possible to achieve what you want:
With the ACL tool, you can use the repository privileges as well as the AEM rights. To achieve what you want, you need to use the repository privileges level.
If you grant someone edit but not create AEM rights in a certain folder, actually two ACEs are created: One granting you modification rights on the page, one granting you creation of subNodes below the jcr:content. This entry is responsible for the ability to add components as well. If you create these two lines manually and only add the privileges responsible for removing nodes, you should be fine.
The two ACE definitions would look as follows (written from memory, typo-prone):
- path: /content/mysite/en/about
permission: allow
privileges: jcr:versionManagement, jcr:modifyProperties, jcr:read, jcr:lockManagement, jcr nodeTypeManagement
- path: /content/mysite/en/about
permission: allow
privileges: jcr:removeChildNodes, jcr:removeNode
restrictions:
repGlob: '*/jcr:content*'
With this setup, the corresponding user would NOT have the rights to create additional pages in this section; but I would assume that's okay given it is a user with very limited rights. If instead page creation should be possible but not adding components to the page, you would have to work with deny statements in the rep:glob rule - I'd try to avoid that (and question the use case). Also, you might have to add crx:replicate for publishing rights - again, unlikely for such a limited user group.
