Understanding JEM Permissions and User Roles

This guide explains how permissions work in JEM 5.0.1 and how administrators can combine Joomla user groups, Joomla ACL, JEM User Control, JEM Groups, ownership and access levels to build practical frontend and backend roles.

Permission Systems at a Glance

JEM uses several related mechanisms. They have different purposes and should not be treated as interchangeable.

Frontend Permissions

Frontend contributors must be logged in. JEM then evaluates the requested action using the permission paths that apply to that action. User Control, Joomla ACL and JEM Groups can provide alternative grants; they are not three mandatory approvals that must all succeed.

Create an Event or Venue

Frontend creation can be granted by any applicable route:

• User Control allows all registered users to create events or venues.
• Joomla ACL grants core.manage or core.create for JEM.
• A JEM Group grants Add Event or Add Venue to a user listed as a Maintainer.

For event submissions, the user must also be able to use at least one suitable published category. A category's Joomla access level and its assigned JEM Group can affect which categories are available through the maintainer path.

Edit an Event or Venue

Editing can be granted by Joomla's general edit permission, an applicable User Control rule, a matching JEM Group permission, or an Edit Own rule.

Publish an Event or Venue

Publishing can be granted by Joomla core.edit.state, an applicable JEM autopublish rule, or a JEM Group publish permission. Autopublish controls eligible frontend submissions and owner-related workflows; it is not the same as unrestricted permission to change the state of every record.

Delete an Event or Venue

Frontend deletion requires Joomla core.delete or core.manage. User Control and JEM Groups do not provide a delete permission.

How JEM Groups Work in the Frontend

• Available users are only candidates that can be assigned to the group.
• Maintainers are the actual JEM Group members.
• The group's Add, Edit and Publish options define the frontend actions its maintainers may perform.
• For events, assigning the JEM Group to a category connects the maintainers to that category.
• Venue group permissions do not use the event-category-to-group relationship.

Frontend Configuration Examples

Example 1: Registered Users Submit Events for Review

This role allows registered users to submit and maintain their own events while an administrator controls publication.

1. Create or use a Joomla user group whose members can log in to the site.
2. In JEM Settings → User Control, set Create Events to All Registered Users.
3. Enable Edit Own Events.
4. Leave Autopublish limited to administrators and JEM Groups.
5. Provide at least one published category that these users can view and select.

Result: users can submit events and edit their own records, but their submissions remain unpublished until an authorised reviewer publishes them.

Example 2: Category Maintainers

This role gives selected users responsibility for one event category without granting backend access.

1. Create a JEM Group named, for example, Sports Editors.
2. Move the selected users from Available users to Maintainers.
3. Enable the required Add Event, Edit Event and Publish Event permissions in that JEM Group.
4. Assign the JEM Group to the Sports JEM category.
5. Confirm that the maintainers belong to a Joomla access level that can view the category.

Result: the maintainers can use their configured frontend event rights for the connected category. They do not receive access to JEM's backend.

Example 3: Joomla ACL Frontend Editor

A site can also grant frontend actions through Joomla ACL. Create a Joomla user group and grant only the JEM component actions it needs, such as core.create, core.edit, core.edit.own or core.edit.state.

Result: Joomla ACL can independently grant the corresponding frontend action. Review User Control and JEM Groups as well so that another route does not unintentionally grant broader access.

Backend Permissions

The Joomla administrator area follows a different policy. Every backend user first needs Joomla core.manage permission for JEM to enter the component. Event and venue operations are then controlled by Joomla ACL. Frontend User Control and JEM Groups do not grant backend access.

Enter the JEM Backend

• core.manage is required to open JEM in the Joomla administrator.
• core.admin grants full control over JEM.
• Without core.admin, JEM continues with the resource and operation checks.

Event and Venue Resource Access

A restricted backend role needs access to the type of content it will manage:

• jem.events.access to access event administration.
• jem.venues.access to access venue administration.

The corresponding resource-access permission is required before JEM evaluates create, edit, change-state or delete permission for that resource.

Operation-Specific Permissions

Backend Edit Own succeeds only when the user has the corresponding edit.own permission and the creator loaded from the stored record matches the current Joomla user. Permission to change the creator is deliberately separate from ordinary editing.

Other Backend Areas

• Settings requires core.options or full control.
• Attendee management requires event access together with jem.attendees.manage.
• Import, export, housekeeping, sample data, CSS management and update tools require jem.tools.manage or full control.
• Categories use the applicable Joomla category permissions.

Backend Configuration Examples

Example 1: Event Manager Without Delete Permission

1. Create a Joomla user group named JEM Event Managers.
2. Grant JEM core.manage.
3. Grant jem.events.access, jem.events.create, jem.events.edit and jem.events.edit.state.
4. Do not grant jem.events.delete or jem.events.edit.created.
5. If the managers must browse or select venues in backend workflows, also grant the required venue access.

Result: the role can enter JEM and manage the normal event workflow, but cannot delete events or change their recorded creator.

Example 2: Venue Manager

1. Create a Joomla user group named JEM Venue Managers.
2. Grant core.manage and jem.venues.access.
3. Grant only the required venue create, edit and state permissions.
4. Do not grant event access unless the role also needs to work with event administration.

Result: the role can maintain venues without automatically receiving event-management permissions.

Example 3: Publication Reviewer

1. Grant core.manage and jem.events.access.
2. Grant jem.events.edit.state.
3. Do not grant general event editing or deletion.

Result: the reviewer can change event publication state without receiving permission to modify all event content or delete records.

Example 4: Backend Edit Own Role

1. Grant core.manage and the appropriate event or venue access permission.
2. Grant the corresponding jem.events.edit.own or jem.venues.edit.own permission.
3. Do not grant general *.edit if the user must be restricted to records they own.

Result: JEM compares each stored record owner with the current user before allowing editing.

Recommended Permission Testing

1. Create a dedicated Joomla test account for each intended role.
2. Log out of the administrator account and log in as the test user.
3. Test visible menu links and the equivalent direct URLs.
4. Test create, edit-own, edit-another-user's-record, publish and delete separately.
5. For event maintainers, test both a category assigned to their JEM Group and a category assigned to another group.
6. Test records with different Joomla access levels.
7. Confirm that hidden buttons are also protected when the action URL is opened directly.
8. Log out and back in after changing Joomla group membership or ACL if the current session still reflects old permissions.

Troubleshooting

The user cannot see a frontend submit action

• Confirm that the user is logged in.
• Check the menu item's access level.
• Review JEM User Control, Joomla ACL and JEM Group membership.
• Confirm that an appropriate published category is visible and selectable.

The event form opens but no category can be selected

• Confirm that the category is published.
• Check the category's Joomla access level.
• If the category has a JEM Group, confirm that the user is listed under Maintainers and that the group has the required event permission.

A user appears under Available Users but has no JEM Group rights

Move the user to the Maintainers list and save the JEM Group. Available Users are not group members.

The user can enter JEM but cannot open Events or Venues

core.manage permits entry to the component, but the role also needs jem.events.access or jem.venues.access for the relevant resource.

The user can edit but cannot publish

Edit and change-state permissions are separate. Review the applicable frontend autopublish or JEM Group rule, or grant the appropriate Joomla edit-state permission.

A JEM Group change has no effect in the backend

This is expected. JEM Groups provide frontend maintainer rights. Configure backend roles through Joomla ACL.

Related Documentation

• User Control
• Add or Edit a JEM Group
• Submit Event
• Backend Events
• Backend Venues
• Add or Edit a Category