Taxonomy_access: Restrict user roles to access specific categories only

Allows the user administrator to control access to nodes indirectly, by controlling which roles can access which categories.   http://drupal.org/project/taxonomy_access

Permissions can be set differently to each USER ROLES. Be aware that setting Taxonomy Access permissions works ONLY WITHIN ONE USER ROLE.
(For users with multiple user roles, see section "GOOD TO KNOW" below.)

On the category permissions page for each role, each category (vocabulary) displays a list of the terms within it, each with five types of permission: View, Update, Delete, Create and List:

• VIEW enables the user to access content (nodes) with given term.
• UPDATE, DELETE enables the user to Update/Delete ALL nodes with the given term.
  
  (These two permissions are administrator permissions, that should be given ONLY to e.g. content administrators.)
• CREATE enables the user to set that term when adding a new node or when editing a node.
• LIST enables the user to view the name of the given term below the title of a node or in category lists. It also controls whether a user can access the taxonomy page for the given term. (e.g. "taxonomy/term/*")

VIEW, UPDATE, and DELETE control the node access system. LIST and CREATE control if a user can view and select a given term. (Note: In previous versions of Taxonomy Access Control, there was no LIST permission; its functionality was controlled by the VIEW permission.)

VIEW, UPDATE and DELETE have three options for each term: Allow, Ignore, and Deny. Indicate which rights each role should have for each term.

CREATE and LIST have only two options for each term: YES (selected) or NO (deselected). Indicate what each role should be allowed to do with each term.

IMPORTANT NOTE:

The DENY directives are processed after the ALLOW directives. (DENY overrides ALLOW.) So, if a multicategory node is in Categories "A" and "B" and a user has ALLOW permissions for VIEW in Category "A" and DENY permissions for VIEW in Category "B", then the user will NOT be permitted to VIEW the node. (DENY overrides ALLOW.)

Access is denied by default. So, if a multicategory node is in Categories "C" and "D" and a user has IGNORE permissions for VIEW in both Category "C" and "D", then the user will NOT be permitted to VIEW the node.

(If you are familiar with Apache mod_access, this permission system works similar to directive: ORDER ALLOW, DENY)

Allow/Ignore/Deny All or Select/Deselect All:

Beside each vocabulary title there are dropdowns containing the options that can be set for individual terms. Selecting one of these options using the dropdown effectively selects that option for ALL of the individual terms inside that vocabulary when the options are saved.

Selecting "--" does not make any automatic changes to the permission of the terms in that vocabulary; only manual changes that you make will be saved.

NOTE: This does not change the "Default" option (described below).

Default:

This option, just underneath the vocabulary title, sets the permission that will automatically be given to the role, for any new terms that are added within the vocabulary. This includes terms that are added via free tagging.

GOOD TO KNOW:

Users with multiple user roles: Allow/Ignore/Deny options are interpreted only within one user role. When a user belongs to multiple user roles, then user gets access if ANY of his user roles has the access granted.
In this case, permissions for the given user are calculated, so that the permissions of ALL of his user roles are "OR-ed" together. Meaning that Allow will take precedence over Deny. This is different from how node access permissions (for multi-category nodes) are handled within ONE USER ROLE, as noted above.

Input formats: Node editing/deleting is blocked, even when user has UPDATE/DELETE permission to the node, when user is not allowed to use a filter format that the node was saved at.