2.1: Programmatic Access Control Patterns (Who Can See What)

By Optimizely Education
Published: Mar 16, 2026
Rating 1 star 2 stars 3 stars 4 stars 5 stars

Average rating: 0 No reviews

Outline

At a glance

Governance Goal: Moving security from manual configuration to automated, policy-driven code.
Core Interface: Mastering IContentSecurityRepository for programmatic ACL manipulation.
Data Leakage Prevention: Enforcing the FilterForVisitor wrapper in all custom content retrieval queries.
Modern Security: Leveraging Virtual Roles and HMAC-signed headless tokens for federated environments.

In an enterprise PaaS environment, security is not just a feature; it is a foundational pillar of architecture. While many developers rely on the CMS Admin UI to manage Access Control Lists (ACLs), senior Optimizely architects often need to implement security programmatically. Whether you are automating the creation of secure asset folders for a global team or building a personalized portal where content visibility depends on complex CRM data, understanding the programmatic security APIs is essential for achieving the **PaaS CMS 13 Developer Certification**.

Access Control Patterns in Optimizely refer to the technical logic used to determine, enforce, and modify the permissions assigned to content. This activity moves beyond simple "Read/Write" checks and explores the deep integration of IContentSecurityRepository and the FilterForVisitor logic required to prevent data leakage in custom C# logic.

1. The Core Interface: IContentSecurityRepository

The IContentSecurityRepository is the primary interface used to load, modify, and persist security settings for specific content items. To change who can see a specific page or folder, you must first load its existing IContentSecurityDescriptor, create a writable clone, manipulated the AccessControlEntry list, and then save it back.

var securityRepository = _services.GetInstance<IContentSecurityRepository>();
var descriptor = securityRepository.Get(contentLink).CreateWritableClone() as IContentSecurityDescriptor;

if (descriptor != null)
{
    descriptor.AddEntry(new AccessControlEntry("PremiumUsers", AccessLevel.Read));
    securityRepository.Save(contentLink, descriptor, SecuritySaveBundle.None);
}

2. The "Filter for Visitor" Discipline

One of the most dangerous developer anti-patterns is retrieving content via IContentLoader and displaying it directly in a custom listing or API without checking permissions. The GetChildren<T> method returns content regardless of the current user's permissions. To solve this, you must pass your results through the FilterForVisitor helper.

public IEnumerable<IContent> GetAccessibleContent(ContentReference parent)
{
    var rawItems = _loader.GetChildren<NewsPage>(parent);
    // Correct Pattern: Filter automatically handles ACLs and Publication Status
    return FilterForVisitor.Filter(rawItems); 
}

3. Permission Inheritance and Virtual Roles

Programmatically, permission hierarchy is managed via the IsInherited property. Breaking inheritance requires explicitly setting this to false and copying preferred parent rules to the new child descriptor. Furthermore, senior developers utilize **Virtual Roles**—roles calculated at runtime based on logic—to grant access to federated users (e.g. "Grant Read if user claims 'OfficeLocation' is 'Dublin'").

4. Securing Headless Gateways (Optimizely Graph)

In a headless scenario, programmatic access control must transition to HMAC Authentication. For restricted content (non-'Everyone' group), you must sign your JSON requests using HMAC so that Optimizely Graph knows which internal roles the request represents. Relying on simple browser sessions is insufficient for modern cross-channel federated app security.

Conclusion

Programmatic access control in Optimizely CMS 13 is a sophisticated discipline that moves beyond simple user management into the realm of dynamic, context-aware authorization. By mastering the IContentSecurityRepository for ACL manipulation, enforcing the FilterForVisitor discipline in all custom queries, and effectively leveraging virtual roles and HMAC-signed API calls, developers create a robust security architecture that protects digital assets at the point of delivery. This technical expertise ensures that the platform can support complex multi-tenant and global branding requirements while maintaining the high-security standards necessary for a certified PaaS environment.