What It Controls
Every page has an access level, which sets the first rule for who can open it. Private pages can also use one or more security policies to narrow that access.
Menu items can have their own security policies, separate from the page they link to. Those policies hide the menu item from visitors who do not qualify, but they do not protect the page itself. The page’s own access level and policies control who can open it.
Turning on a page does not limit who can reach it. For example, when you turn on the Chapter Management area, all officers can access it by default. To limit access to a specific officer position, add a security policy. To limit access to certain chapters, use the relevant page settings.
Where to Find It
Set a page’s access level and security policies when you create the page, or update them later in the page’s settings. Set a menu item’s policies in the menu designer while you edit that item.
Prerequisites
- You need separate permissions to open the Pages and Menus screens, and separate permissions to create, edit, and delete items on each screen.
- To reach a page’s settings or a menu item’s editor, you need the permission that lets you open that screen.
A page's access level decides who can open it after you publish the page. Security policies narrow access further for pages and individual menu items, so visitors must meet one or more conditions.
What It Controls
Every page has an access level, and private pages can also use one or more security policies. Menu items can have their own security policies, separate from the page they link to. A menu item policy hides that item from visitors who do not qualify, but it does not protect the page itself. The page's own access level and policies control who can open it.
Where to Find It
Set a page's access level and policies when you create the page, or update them later in its settings. Set a menu item's policies in the menu designer while you edit that item.
Prerequisites
- Opening the Pages and Menus screens each requires its own view permission, with separate permissions to create, edit, and delete.
- To reach a page's settings or a menu item's editor, you need the permission that opens that screen.
Page Access Levels
| Access Level | Icon Shown in Lists | Meaning |
|---|---|---|
| Public | Open lock | Anyone with the link can view the page |
| Requires Login & Rolodex Record | Closed lock | The page is private, and visitors must sign in with a Rolodex contact record |
| Requires Login w/o Rolodex Record | Alternate closed lock | The page is private, but visitors can sign in without having or creating a Rolodex record |
The page form shows security policies only when the access level is Requires Login & Rolodex Record. If you choose policies and then change the page to another access level, the policy fields disappear from the form, but the saved policies stay on the page and continue to apply.
| Access Level | Icon Shown in Lists | Meaning |
|---|---|---|
| Public | Open lock | Anyone with the link can view the page |
| Requires Login & Rolodex Record | Closed lock | The page is private and restricted to signed-in visitors who have a Rolodex contact record |
| Requires Login w/o Rolodex Record | Alternate closed lock | The page is private, but visitors can sign in without having or creating a Rolodex record |
Security policies appear in the page form only for the Requires Login & Rolodex Record level. If you change the access level after choosing policies, the policy fields disappear from the form, but the selected policies stay on the page and continue to apply.
Restricting a Page with Security Policies
Open the page’s create or edit form, and set its access level to Requires Login & Rolodex Record.
In Security Policies:, choose one or more policies. Leave it blank to allow every registered visitor who meets the access level.
If you choose more than one policy, choose how Rhythm should combine them: All means a visitor must meet every policy, Any means at least one, and None means none of them.
Open the page's create or edit form, and set its access level to Requires Login & Rolodex Record.
In Security Policies:, choose one or more policies. Leave it blank to allow every registered visitor who meets the access level.
If you choose more than one policy, choose how they combine: All means a visitor must meet every policy, Any means at least one, and None means none of them.
Save the page.
Result
After you publish the page, visitors must meet the access level and the selected policies, combined the way you chose.
Broad permissions elsewhere do not automatically give someone access to a restricted page. For example, a Billing Contact does not see or open the Organization Account Summary page unless that page's security policy explicitly includes the Billing Contact role.
Restricting a Menu Item
Each menu item has the same policy and combination fields in the menu designer’s item editor, no matter what the item links to. Policies on a menu item only hide that item from the visible menu; they do not restrict the page or address behind it. If the destination also needs protection, restrict it with its own access level or policies.
Warning
The published menu file still includes every item, including restricted items. Anyone who fetches that file directly, instead of using the rendered menu, can see the restricted items listed.
After you publish the page, it allows only visitors who meet the access level and the selected policies, combined the way you chose.
Restricting a Menu Item
Each menu item has the same policy and combination fields in the menu designer's item editor, no matter what the item points to. Hiding a menu item with policies only keeps it out of the visible menu. It does not restrict the page or address behind the item, so protect the destination with its own access level or policies if it also needs to be restricted.
Warning
The published menu file still lists every item, including restricted ones. Anyone who fetches that file directly, rather than using the rendered menu, can see the restricted items listed.
Deleting a Security Policy That Is Still in Use
You cannot delete a security policy while a page still refers to it, so remove the policy from the page first. This check does not include menus: if a policy is used only by menu items, you can delete it, and those menu items still point to the deleted policy.
Permissions
Viewing, creating, editing, and deleting pages and menus each require their own permission. Publishing, reverting, and deleting a page from inside the page designer use the same permission as editing that page there.
You cannot delete a security policy while a page still refers to it, so remove the policy from the page first. This check does not extend to menus: if a policy is used only by menu items, you can delete it, and those menu items are left pointing to a policy that no longer exists.
Permissions
Viewing, creating, editing, and deleting pages and menus each require their own permission. Publishing, reverting, and deleting a page from inside the page designer use the same permission as editing it there.