Hide taxonomy for Admin users

[agyawa]

I am trying to hide a taxonomy path (for example, /content/dam/test and /content/site/test_page) from all users, including administrators. I was able to successfully hide it for all non-admin users by configuring ACLs in repo-init scripts. However, admins are still able to see the taxonomy path. How can I prevent admins from seeing it as well?

[lukasz-m]

Hi @agyawa,

This might not be possible. Or in other words, what you can see could be expected result. Please check official documentation about built in users/groups.

Even if you set a 'deny-everyone' on a node, the administrators can still access the node

Link to documentation: https://experienceleague.adobe.com/en/docs/experience-manager-65/content/security/security#built-in-...

[agyawa]

Hi @lukasz-m . Thanks for confirming. 
Will it be possible to make use of granite:rendercondition in the page path, to make it invisible from UI. 
I know it can be used to hide buttons, toolbar actions. 

[lukasz-m]

Hi @agyawa,

I do not think using granite:rendercondition is the way to go. Main reason is that granite:rendercondition is designed to conditionally hide GUI elements, not necessarily content paths. It also might not be possible to use it against content paths.

I am not sure what exactly is your case, but in my opinion the cleanest solution will be to create custom group (custom-administrators) that will be similar to administrators group, except the paths you would like to restrict. And use it instead of OOTB administrators. This will give you full control on permission level.

[HrishikeshKagne]

Hi @agyawa ,

You can't hide content from the built-in administrators group in AEM - they have unrestricted access by design.

1. Don't use admin accounts for day-to-day work - Create custom user groups with limited permissions instead of giving people admin access
2. Remove users from administrators group - Only keep true system admins in that group, create separate groups like "content-admins" or "dam-managers" with specific ACLs
3. Use a service account pattern - If you need programmatic access, use service users with specific permissions rather than admin credentials

The administrators group has implicit full access to the repository - ACL restrictions don't apply to them. This is by design for system maintenance and disaster recovery.

Re-evaluate who actually needs admin access. Most users (even power users) should have custom permission groups with deny ACLs applied, not full admin rights.