# OG Content Access in Drupal — Liran Tal

About authorization in Drupal with a module to control access to content based on OG membership

Canonical: https://lirantal.com/blog/2013-08-29

![Cover artwork for OG Content Access in Drupal](/_astro/photo-1468956398224-6d6f66e22c35.BePqp3CW_Zj88Tk.jpg)

[Drupal](http://drupal.org/) has a flexible access control list ([ACL](http://en.wikipedia.org/wiki/Access_control_list)) system, where it provides permissions and roles (also known as [RBAC](http://en.wikipedia.org/wiki/Rbac), Role Based Access Control) per user. This eases administrators job by allowing them to group users into different classes or categories (roles) to create differentiation in user’s capabilities. While this fits most web applications built on top of Drupal it doesn’t fit them all.

Drupal’s fault at this is that it is designed to be **very** permissive by default. In most cases, this means that users are generally allowed to see everything (even though they may not be able to create, edit or delete). This is the case with [Organic Groups](https://drupal.org/project/og) as well. When users in a Drupal+OG website becomes a member of a community, they may not be able to create/edit/delete some content types, but they will definitely, by default, be able to see (have read permissions, per say) all of the content in that group.

This is where [OG Content Access](https://drupal.org/project/og_content_access) module comes in… it provides the ability to rely on [group-specific roles](https://drupal.org/project/og_user_roles) for providing (view/load) access to specific content. The use-case is as follows: you have a group with several content types – blog, announcements, file downloads. Any members of that group will automatically have access to view any of the above contents. You can control access to create, delete, and edit content for different roles, yes, but every member will **always** have access to view all of the contents of a group.

[With this module you can restrict viewing each content to different members by setting the role which is allowed to view/access each content and then](http://enginx.com/content/implementing-user-specific-role-based-access-control-node-type-group-part-2), within the group context you may assign roles as necessary for each member.

## More writing

[All writing](/blog)

*   Sep 5, 2026

    ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026

    ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026

    ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)


* * *

Liran Tal is the author of the book [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/)

[Start Building Secure Node.js Applications](https://www.nodejs-security.com/)

 [![](/_astro/nodejs-secure-coding-book-3d-style.DiTWpzFs_Z3c7s1.png)](https://www.nodejs-security.com/)