Access level privileges in the ACL

After you assign an access level to each user, group, and server, you can select or deselect privileges within an access level.

This table lists the user access level privileges from highest to lowest. The section that follows describes each privilege in detail.

Table 1. User Access Level privileges
Access level	Default privileges	Optional privileges
Manager	Create documents Create private agents Create personal folders/views Create shared folders/views Create LotusScript/Java agents Read public documents Write public documents	Delete documents Replicate or copy documents
Designer	Create documents Create private agents Create personal folders/views Create shared folders/views Read public documents Write public documents	Delete documents Create LotusScript/Java agents Replicate or copy documents
Editor	Create documents Read public documents Write public documents	Delete documents Create private agents Create personal folders/views Create shared folders/views Create LotusScript/Java agents Replicate or copy documents
Author	Read public documents	Create documents Delete documents Create private agents Create personal folders/views Create LotusScript/Java agents Write public documents Replicate or copy documents
Reader	Read public documents	Create private agents Create personal folders/views Create LotusScript/Java agents Write public documents Replicate or copy documents
Depositor	Create documents	Read public documents Write public documents Replicate or copy documents (available only if access toRead public documents has been granted)
No Access	None	Read public documents Write public documents Replicate or copy documents (available only if access to Read public documents has been granted)

Create documents

Select this privilege for all users with Author access. If you deselect this privilege to prevent Authors from adding any more documents, they can continue to read and edit documents they've already created.

Delete documents

Authors can delete only documents they create. If this privilege is deselected, an author can't delete documents, no matter what the access level. If the form contains an Authors field, Authors can delete documents only if their name, or a group or a role that contains their name, appears in the Authors field.

Create private agents

A user can run only agents that perform tasks allowed by the user's assigned access level in the ACL.

Whether or not a user can run agents is dependent on the access set by the IBM® Domino® administrator in the Programmability Restrictions section of the Server document in the Domino Directory. If you select Create LotusScript/Java agents for a name in the ACL, the Server document controls whether or not the user can run the agent on the server.

Since private agents on server databases take up disk space and processing time on the server, you may want to disallow this privilege.

Create personal folders/views

Personal folders and views created on a server are more secure than those created locally, and they are available on multiple servers. Also, administrative agents can operate only on folders and views stored on a server.

If the Create personal folders/views privilege is not selected, users can still create personal folders and views, but the folders and views are stored on their local workstations. Deselect this privilege to save disk space on a server.

Create shared folders/views

Deselect this privilege to maintain tighter control over database design. Otherwise, a user assigned this privilege can create folders and views that are visible to others.

Important: Users who have this privilege can modify or delete any shared folder, view, or navigator in the database, regardless of whether they created it. Use caution when granting this privilege.

Use similar caution when assigning this privilege to a server. For example, in a hub-and-spoke configuration, a spoke server typically has Editor access; if it also has this privilege in its ACL entry, the potential exists for replication back to the hub to affect the following design elements: views, folders, shared columns, and navigators. If you want your hub server to control all design elements, do not grant this privilege to spoke servers.

Create LotusScript/Java agents

Since LotusScript® and Java™ agents on server databases can take up significant server processing time, you may want to restrict which users can create them.

Whether or not a user can run agents depends on the access set by the Domino administrator in the Programmability Restrictions section of the Server document in the Domino Directory. If you select Create LotusScript/Java agents for a name in the ACL, the Server document controls whether or not the user can run the agent on the server.

Read public documents

Select this privilege to allow users who have No Access or Depositor access to read documents or to see views and folders to which the designer assigned the property Available to Public Access users. The form must contain a text field named $PublicAccess, and its value should be equal to 1.

Note: If the privilege Read Public Document is granted to users have No Access or Depositor access, you can also enable the privilege Replicate or copy document.

Write public documents

Select this privilege to allow users to create and edit specific documents that are controlled by forms to which the designer has assigned the property Available to Public Access users. This option lets you give users create and edit access to specific documents without giving them Author access. Author access, or an equivalent role, gives users access to create documents from any form in a database.

Note: Users who have this privilege can also delete any public documents in the database.

Replicate or copy documents

Users who have this privilege can perform the following tasks:

Create a new local replica or local copy of a database
Copy, print, or forward documents from the database, or parts of these documents
Select all text in a document opened in read mode

Note: Deselecting this option is not a true security measure because users can still print using Ctrl+Print Screen or they can open a document and copy data to the clipboard.

You can select this privilege for all access levels. However, for users with access levels of Depositor and No Access, you can only enable this if Read public document has also been granted.