# User Permission on foreign entries

**URL:** <https://discourse.getcockpit.com/t/user-permission-on-foreign-entries/1863>\
**Category:** Support\
**Created:** [March 11, 2021, 5:10pm UTC](https://discourse.getcockpit.com/t/user-permission-on-foreign-entries/1863 "2021-03-11T17:10:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gmichel](https://avatars.discourse-cdn.com/v4/letter/g/ed8c4c/32.png) [@gmichel](https://discourse.getcockpit.com/u/gmichel)\
**Post date:** [March 11, 2021, 5:10pm UTC](https://discourse.getcockpit.com/t/user-permission-on-foreign-entries/1863/1 "2021-03-11T17:10:45Z")

</div>

Hey Community and Support Team,

i love Cockpit and use it to build a SaaS application with vue.js.  
Everything is working fine but my problem are the permission settings.

I hoped that an author can only get entries which he/she has inserted.  
But Authors can also see and modify all entries. How to setup the permissions that the author can effect just on its entries?

Kind regards,  
G.

---

<div class="post-metadata">

**Author:** ![raffaelj](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/raffaelj/32/331_2.png) [@raffaelj](https://discourse.getcockpit.com/u/raffaelj)\
**Post date:** [March 22, 2021, 11:11am UTC](https://discourse.getcockpit.com/t/user-permission-on-foreign-entries/1863/2 "2021-03-22T11:11:01Z")

</div>

Have a look here:

> [@Restrict content to the content authors](https://discourse.getcockpit.com/t/restrict-content-to-the-content-authors/285):
>
> I want my users to be able to view and edit only collection posts they have created. Is this something I would implement in the config file or programmatically? If so, any help would be much appreciated. Also, I will have a hidden boolean field created on each collection post only accessible by admions. Once that field is set to true only admins should be able to see/edit that post. This access to author’s own content will be more restrictive than just user groups.

Alternatively to the context rules, you can use the `collections.find.before` event to adjust the filter to search only for entries with `_by => $user['_id']`.

---

<div class="post-metadata">

**Author:** ![gmichel](https://avatars.discourse-cdn.com/v4/letter/g/ed8c4c/32.png) [@gmichel](https://discourse.getcockpit.com/u/gmichel)\
**Post date:** [April 30, 2021, 11:40am UTC](https://discourse.getcockpit.com/t/user-permission-on-foreign-entries/1863/3 "2021-04-30T11:40:50Z")

</div>

Hey Rafael. Yes i want to start building cutom endpoints to make the application more secure.