Access control

I'm thinking of implementing the following use case to demonstrate the level of access control that can be achieved with WP + CiviCRM. The use case is based on the requirements related to high-net-worth individuals for NGOs.

In our minimal implementation, we will:

1. Create two WordPress users - `Basic` and `Privileged` these can be two different NGO employees.
2. Create a contact - it can be a `High Net-worth Individual`. There will be some sensitive/private information associated with this contact which NGOs want to restrict to certain users only.
3. When the `Basic` user visits the CiviCRM dashboard and opens the contact, she will not be able to see the sensitive information.
4. When the `Privileged` user visits the CiviCRM dashboard and opens the contact, she will be able to see the sensitive information.

The granularity of access control here is a Group of custom fields.

In our next iteration, we can get more granular and see how individual field can be access restricted.

After that we can also see how we can get less granular - we access limit the entire contact for users. What if they say we have some sensitive people on our list which we don't want others in the NGO to know about.