Users, Groups, and Permissions
What to know
AEM security rests on users, groups, and ACLs. Candidates must understand principals, permissions (read, modify, create, delete, replicate), and privileges mapped to permissions. Know closed user groups and the difference between author and publish permissions.
Understand impersonation, admin console user management (IMS), and product profiles that map to AEM groups. Know that permissions are evaluated on the content path, and that deny takes precedence over allow.
Know replication permissions control who can publish, and that group membership is the recommended way to grant access rather than per-user ACLs.
Traps
- Deny overrides allow at the same path.
- Permissions are inherited down the tree; a deny lower in the tree can block inherited allow.
- Product profiles in Admin Console map to AEM groups; they are not the same as AEM groups themselves.
- Impersonation requires explicit permission and is audited.
- Replicate permission is separate from modify permission.
Rule of thumb
Grant access by adding the user to a group with the right ACLs on the correct path - never by editing individual ACLs per user unless unavoidable.
Worked example: A contributor can edit but not publish. Add them to a group with read/modify on /content/site but without replicate; publishing then requires an approver with replicate rights.