Administration, Permissions, and Business Practitioner Practices
Administration covers users, groups, and permissions. AEM uses ACLs (access control lists) applied on paths, with privileges like jcr:read, jcr:write, crx:replicate. Know the built-in groups: content-authors, dam-users, workflow-users, administrators. Permissions are granted on paths, and closed user groups (CUGs) restrict published content to authenticated users. A frequent trap is confusing permissions (what a user can do) with privileges (the granular right) - permissions are the effective result of privileges granted via ACLs.
Know the Tools console areas: Security (users/groups/permissions), Operations (replication agents, workflows), Deployment (packages), and Assets (metadata schemas, processing profiles). Understand package manager for content/code transfer and backup/version purging for maintenance.
Business practitioner practices: use launches for staged content, workflows for approval, tags for taxonomy, and reports for governance. Know that replication permissions should be restricted so authors cannot publish directly when approval is required. Also know CUG vs. permission on author - CUG affects publish-side access, not author-side editing.
Worked example: a client wants only the marketing group to publish, while authors can edit. The practitioner creates a group, grants crx:replicate on /content/<site> to that group, and removes it from content-authors. Testing with a sample user in the Permissions tab (User/Group admin) confirms the effective rights before go-live.