{"result":{"depiction_url":null,"edges":{"hasreference":{"objects":[{"created":"2026-10-07T11:13:39Z","object_id":{"id":3054,"is_a":["text","documentation","adminguide"],"name":"admin_assign_access","title":{"_type":"trans","tr":{"en":"Assign user groups and check access"}},"uri":"https:\/\/zotonic.com\/id\/3054"},"seq":1},{"created":"2026-10-07T11:13:39Z","object_id":{"id":3055,"is_a":["text","documentation","adminguide"],"name":"admin_access_rules","title":{"_type":"trans","tr":{"en":"Test and publish access rules"}},"uri":"https:\/\/zotonic.com\/id\/3055"},"seq":2},{"created":"2026-10-07T11:13:39Z","object_id":{"id":1536,"is_a":["text","documentation","developerguide"],"name":"doc_developerguide_access_control","title":{"_type":"trans","tr":{"en":"Keep permission checks at the boundary"}},"uri":"https:\/\/zotonic.com\/id\/1536"},"seq":3}],"predicate":{"id":2774,"is_a":["meta","predicate"],"name":"hasreference","title":{"_type":"trans","tr":{"en":"Documentation reference"}},"uri":"https:\/\/zotonic.com\/id\/hasreference"}},"relation":{"objects":[{"created":"2020-05-30T05:48:17Z","object_id":{"id":2010,"is_a":["text","documentation","reference","module"],"name":"doc_module_mod_signup","title":"mod_signup","uri":"https:\/\/zotonic.com\/id\/2010"},"seq":1000000}],"predicate":{"id":303,"is_a":["meta","predicate"],"name":"relation","title":{"_type":"trans","tr":{"nl":"Relatie","en":"Relation"}},"uri":"http:\/\/purl.org\/dc\/terms\/relation"}},"subject":{"objects":[{"created":"2026-10-07T11:13:39Z","object_id":{"id":2557,"is_a":["categorization","keyword","keyword_information_type"],"name":"zotonic_topic_cookbook_recipe","title":"Cookbook recipe","uri":"https:\/\/zotonic.com\/id\/2557"},"seq":1},{"created":"2026-10-07T11:13:39Z","object_id":{"id":2564,"is_a":["categorization","keyword","keyword_audience"],"name":"zotonic_topic_backend_developer","title":"Backend developer","uri":"https:\/\/zotonic.com\/id\/2564"},"seq":2},{"created":"2026-10-07T11:13:39Z","object_id":{"id":2589,"is_a":["categorization","keyword","keyword_domain"],"name":"zotonic_topic_identity_and_accounts","title":"Identity and accounts","uri":"https:\/\/zotonic.com\/id\/2589"},"seq":3},{"created":"2026-10-07T11:13:39Z","object_id":{"id":2592,"is_a":["categorization","keyword","keyword_domain"],"name":"zotonic_topic_authorization_and_access_control","title":"Authorization and access control","uri":"https:\/\/zotonic.com\/id\/2592"},"seq":4},{"created":"2026-10-07T11:13:39Z","object_id":{"id":2627,"is_a":["categorization","keyword","keyword_architecture"],"name":"zotonic_topic_notification","title":"Notification","uri":"https:\/\/zotonic.com\/id\/2627"},"seq":5}],"predicate":{"id":308,"is_a":["meta","predicate"],"name":"subject","title":{"_type":"trans","tr":{"en":"Keyword"}},"uri":"http:\/\/purl.org\/dc\/elements\/1.1\/subject"}}},"id":1596,"is_a":["text","documentation","cookbook"],"links":[{"rel":"self","target":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/1596"},{"rel":"hub","target":"https:\/\/zotonic.com\/.zotonic\/websub"}],"medium":null,"medium_url":null,"name":"doc_cookbook_admin_user_group","page_url":{"en":"https:\/\/zotonic.com\/cookbook\/1596\/assign-a-user-group-from-a-trusted-creation-workflow","x-default":"https:\/\/zotonic.com\/cookbook\/1596\/assign-a-user-group-from-a-trusted-creation-workflow"},"preview_url":null,"resource":{"body":{"_type":"trans","tr":{"en":"<p>A person resource and a login identity are separate. If your administrative workflow creates a person in a special category, add the membership <strong>after<\/strong> resource creation succeeds. Do not look up the category of an undefined ID inside an insert observer.<\/p>\n<p>For example, create a <code>vip<\/code> subcategory of <code>person<\/code> and a group named <code>acl_user_group_vips<\/code>. Review that group&#39;s permissions before using it. Add this helper to your site application as <code>src\/support\/garden_membership.erl<\/code>:<\/p>\n<pre class=\"notranslate\"><code class=\"notranslate language-erlang\">-module(garden_membership).\n-export([assign\/2]).\n\nassign(UserId, Context) -&gt;\n    case z_acl:is_admin(Context) andalso m_rsc:is_a(UserId, vip, Context) of\n        true -&gt;\n            case m_rsc:rid(acl_user_group_vips, Context) of\n                undefined -&gt; {error, missing_group};\n                GroupId -&gt; m_edge:insert(UserId, hasusergroup, GroupId, Context)\n            end;\n        false -&gt;\n            {error, eacces}\n    end.\n<\/code><\/pre>\n<p>Compile, then call <code>garden_membership:assign(UserId, Context)<\/code> from the trusted creation workflow after <code>m_rsc:insert\/2<\/code> has returned <code>{ok, UserId}<\/code>. Expect <code>{ok, EdgeId}<\/code>; handle an error instead of reporting that the complete workflow succeeded. Keep the authenticated administrator context so both this check and the edge model&#39;s checks apply. Do not add <code>sudo<\/code> to make a public signup pass.<\/p>\n<p>Test a VIP, another person category, a non-administrator and a missing group. Confirm the <code>hasusergroup<\/code> connection in admin and test the account&#39;s resulting permissions. Repeat assignment to confirm it does not create duplicate membership.<\/p>\n<p>Ordinary authenticated users without explicit group edges fall back to <code>acl_user_group_members<\/code>. Once explicit groups are assigned, that fallback no longer supplies membership; configure group inheritance deliberately if VIPs should retain those permissions. A broad resource-update observer is a poor place to grant elevated membership based on a category that a visitor might influence.<\/p>"}},"category_id":{"id":318,"is_a":["meta","category"],"name":"cookbook","title":{"_type":"trans","tr":{"en":"Cookbook"}},"uri":"https:\/\/test.zotonic.com\/id\/318"},"content_group_id":{"id":339,"is_a":["meta","content_group"],"name":"default_content_group","title":{"_type":"trans","tr":{"en":"Default Content Group"}},"uri":"https:\/\/zotonic.com\/id\/default_content_group"},"created":"2020-05-30T05:47:27Z","creator_id":{"id":336,"is_a":["person","robot"],"name":"gitbot","title":"Git","uri":"https:\/\/zotonic.com\/id\/336"},"doc_editorial_bundle":true,"doc_editorial_edges":{"hasreference":[1536,3054,3055],"subject":[2557,2564,2589,2592,2627]},"github_url":"https:\/\/github.com\/zotonic\/zotonic\/tree\/master\/doc\/cookbook\/admin-user-group.rst","is_authoritative":true,"is_dependent":false,"is_featured":false,"is_protected":false,"is_published":true,"is_unfindable":false,"language":["en"],"modified":"2026-10-07T11:13:48Z","modifier_id":{"id":1,"is_a":["person"],"name":"administrator","title":"Site Administrator","uri":"https:\/\/zotonic.com\/id\/1"},"name":"doc_cookbook_admin_user_group","pivot_geocode":null,"pivot_location_lat":null,"pivot_location_lng":null,"privacy":0,"publication_end":"9999-06-01T00:00:00Z","publication_start":"2022-02-15T10:01:38Z","slug":"assign-a-user-group-from-a-trusted-creation-workflow","summary":{"_type":"trans","tr":{"en":"Add membership after creation with explicit permissions."}},"title":{"_type":"trans","tr":{"en":"Assign a user group from a trusted creation workflow"}},"title_slug":{"_type":"trans","tr":{"en":"assign-a-user-group-from-a-trusted-creation-workflow"}},"tz":"UTC","uri":null,"version":37,"visible_for":0},"uri":"https:\/\/zotonic.com\/id\/1596","uri_template":"https:\/\/zotonic.com\/id\/:id","websub":{"hub":"https:\/\/zotonic.com\/.zotonic\/websub","topic":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/1596"}},"status":"ok"}