Understanding JEM Permissions and User Roles

Inherited, Allowed and Denied

• Inherited: use the effective rules from higher levels. It does not mean Allowed.
• Allowed: grant the action, provided an applicable explicit denial does not override it.
• Denied: explicitly block the action. A child group or resource cannot override an applicable inherited denial with Allowed.

Save the configuration and inspect Calculated Setting. Review all Joomla groups assigned to the user, not only one group.

For selective access: leave the parent permission Inherited, with no inherited grant, and allow only the intended groups/resources. Do not deny a parent group such as Registered if its child groups must receive that same permission. In the 5.0.x frontend, also review the separate User Control and JEM Group grant paths described below.

Administration and General Actions

Events

5.1.0 Event create, edit, edit-own, state and delete permissions can also be evaluated against the event's JEM categories. See category-scoped permissions.

Venues

Categories and Types 5.1.0

Attendees, Notifications and Tools

A permission does not enable a feature disabled by the operating profile. In 5.1.0, notification automation also requires the appropriate profile capability.

Category Management Versus Events in a Category

Open JEM → Categories → Edit category → Permissions.

• Create, Delete, Edit, Edit State and Edit Own: category-management actions. Creating a child category is checked against its parent.
• Create Events, Delete Events, Edit Events, Edit Event State and Edit Own Events: actions on events assigned to that category.

Granting permission to create an event in a category does not grant permission to edit the category itself. Access Categories is the separate backend-list access permission.

For events assigned to multiple categories, all applicable category scopes matter. Do not assume that access to one category authorises changes to an event also assigned to another restricted category.

Frontend precedence: JEM first evaluates the dedicated event/venue resource ACL for the requested action, including the relevant ownership path. An applicable explicit denial prevents falling back to legacy grants for that path; an unset decision can still fall back to User Control, general ACL or JEM Groups. Therefore, leaving an action Inherited is not by itself a guarantee that all legacy frontend grants are disabled.

Use Venue for Events

jem.venues.use controls assigning a venue to an event. It is separate from viewing the venue and from creating, editing or publishing it.

All eligible venues: grant Use Venue for Events to the intended Joomla group in JEM → Options → Permissions. Individual explicit denials still apply.

Selected venues only: leave the component action Inherited with no inherited grant; open each allowed venue and set Permissions → your group → Use Venue for Events → Allowed.

Do not set the component action to Denied if you want to allow individual venues later. Published/access-level checks, Owned Venues and contextual filters still apply. The permission is also checked when saving; changing a submitted venue ID cannot bypass it.

Example A: Agenda Managers Can Use All Venues

1. Create or use a Joomla group named Agenda Managers. The name is only an example.
2. Configure its required event create/edit rights and frontend menu access.
3. In JEM Options, allow Use Venue for Events for this group.
4. Keep venues published and their access levels available to the group.
5. If users should select venues created by other people, set Settings → Global Parameters → Owned Venues to No.

Expected result: the group can assign eligible venues without receiving venue-editing or backend access merely from this permission.

Example B: Culture Editors Use Only Their Categories and Venues

1. Create a Joomla group Culture Editors. Check all its inherited permissions and any other groups assigned to its users.
2. Avoid broad event grants through JEM Options, User Control or JEM Groups if the role must be category-restricted. Leave parent actions Inherited rather than explicitly Denied where child grants are needed.
3. In the Culture category, allow Create Events and the required Edit Events or Edit Own Events action. Grant Edit Event State only if this team should publish.
4. Leave unrelated categories without a grant and verify that no legacy frontend path grants access to them.
5. Leave component-level Use Venue for Events Inherited with no effective grant.
6. Allow Use Venue for Events on the Auditorium and Cultural Centre venues only.
7. Check publication/access levels and test with a non-administrator account.

Expected result: the user can work in the authorised category and select the authorised venues. No venue-editing grant is needed. If an event also belongs to a restricted category, test that combined scope separately.

Example C: Venue Managers Do Not Manage Events

Grant venue administration access and the required venue create/edit/state actions. Do not grant event actions unless needed. Maintaining venues does not require granting permission to create events, and event editors can use those venues without becoming venue managers.

The Venue Selector Says “No Venues Found”

1. Clear the search and reopen the selector to remove stale filter/pagination context.
2. Confirm the venue exists and is published.
3. Check that its Joomla access level includes the user's groups.
4. Check Settings → Global Parameters → Owned Venues. If enabled, only venues created by that user are offered.
5. 5.1.0: inspect the calculated Use Venue for Events permission for the user's groups on the intended venue.
6. 5.1.0: check the Control Panel for a pending ACL migration. Venue selection is blocked while that migration remains incomplete.
7. 5.1.0: if editing a child event, check whether the parent event's venue context limits the selection to that venue or its direct subvenues.

If published venues disappeared from this selector immediately after upgrading from 5.0.2, check the new venue-use permission first. An empty list alone does not prove that venue records were deleted.