Security, Permissions, and Access Control
What to know
AEM security is built on JCR ACLs (allow/deny, per principal, per path), users and groups, and product profiles for cloud. Understand privileges (jcr:read, jcr:write, crx:replicate) and how they aggregate. Know the principals model: users belong to groups; groups carry permissions; permissions are evaluated by path and privilege. Understand closed user groups (CUG) for protected content and Dispatcher security filters.
Forms-specific security
Know how form data is protected: Document Security (encryption, usage rights), Reader Extensions (usage rights only), and submit action authentication. Understand Forms Portal access control and prefill security (data source credentials). Know that FDM data source credentials should be stored securely (not in client-visible config).
Traps
A common trap: deny overrides allow at the same path/principal, and evaluation order matters. Another: group membership grants permissions, not the user directly - questions test transitive inheritance. Watch for confusion between encryption (Document Security) and usage rights (Reader Extensions); they are different controls. Also, CUG protects rendered pages, not the underlying repository.
Rule of thumb
Grant permissions to groups, never individual users; use deny sparingly and only to override an inherited allow.
Worked example
A form must be visible only to the loan-reviewers group. Create the group, assign a CUG on the form page, and grant jcr:read to the group on the content path. Do not grant to individual users - membership handles it.