TAC permissions overriden by core?

What do you mean by "can not see any category"? It cannot see and list the name of the term, controlled by LIST permission? Or nodes assigned to that term, controlled by VIEW permission?

Please read, the help page of the module for instruction /admin/help and the readme.txt of the module, for instructions and troubleshooting.

I see the same here.

I used the devel module to create vocabulary terms and nodes. I made one extra role called test with the permission to edit all story nodes. I gave one user that role. I added one Deny View, Deny Update and Deny Delete rule for one term. I log in as that user and a story node with that term is still listed on the front page and can be edited.

What I am doing wrong? If it is a bug, what should I do to provide you more information?

Apparently the core permission has higher priority and overrules the taxonomy_access module. The question now is if this is feature or bug. The readme.txt suggests in troubleshooting point 1 that only administer nodes overrules, but may be this behaviour changed in D6?

As work around I didn't give any edit rights to the role and used this module to give edit rights to certain terms and as a consequence the role cannot access the others.

If this is feature (not bug) then I would prefer that I can choose either positive or negative logic. May be an extra setting to choose between the two would be useful?

bump

Nobody seems to take this serious. Why? Development of D6 has been abandoned?

Another problem exists with Create permission. At the moment I don't see it work at all. I cannot give a role the right to create certain terms. It is overruled by the missing permission to create the node types. When I give the permission to the role to create certain node types then all vocabularies and categories appear in the form even though I only gave access to some. What I want is allow the role only to create nodes in some categories, but all appear no matter what I do.

How have you configured the "create" and "list" checkboxes?

How have you configured global or vocabulary defaults for all three roles (anonymous, authenticated, and test)?

My understanding of the access control system has always been that modules can grant new access in addition to that granted by other modules, but not necessarily revoke permissions given by other modules. So, for update/delete permissions, I do not grant the user any permissions through the core node module, but instead use TAC to add these permissions (to the default, if appropriate).

The reason create, view, and update all operate differently with TAC is that they all operate differently in core. For view, we merely have the "access content" checkbox covering all content; for create and update, we have the "edit" and "edit own" permissions per content type. However, while view and update grants are both controlled by the node_access table, create permissions are not. See this document for more information:
http://drupal.org/node/408816#appendix

Marked #687614: core permissions overrules TAC ? as duplicate of this issue.

Marked #358175: Create permission not working as duplicate of this issue.

#723468: Disable editing for different roles assigned to differing terms. is also a result of TAC's interactions with core permissions.

#207447: i run in this inconsistency when I was plying with permisions is also about interaction between TAC and core (I think). In that issue, the fact that a user has "Edit all [type] content" permissions in core allows the user to inadvertently un-tag terms set by other users. (This also involves the bug described in #623802: Bugged access control when a node is tagged with multiple terms belonging to different roles.)

Alright, after a couple weeks of research and testing, I believe this is part documentation issue, and part the vocabulary default bugs:
#727696: Global defaults do not work properly on some sites
#727648: Node access not updated on default change

Once the above are fixed, then the following should cover all the issues I've marked as duplicates of this one:

1. Every custom role inherits the "Allow" permissions of the authenticated user configuration. Always configure that first and make it restrictive as possible.
2. Roles must have "access content" permissions in core for TAC's "View" grants to work.
3. Roles must not have "Edit/Delete any [type] content" permissions in core for TAC's "Update" and "Delete" grants to work.
4. Roles must have "Create [type] content" permissions to create nodes. TAC's Create grants don't allow node creation, only adding new tags to (new) nodes.
5. List permission means listings of terms, not of nodes. Roles must have "View" grants to see nodes listed in Views, etc.
6. Deny overrides Allow within a role. If a user has multiple roles, Allow from one role overrides Deny from another.

This information can now be found in the module documentation and, with a patch (#730258: Improve help page and add documentation to edit forms), on the module help page and configuration forms.