# Add "Can't see" logic to category permissions
**URL:** https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456
**Category:** Feature
**Created:** [April 4, 2019, 4:26pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456 "2019-04-04T16:26:22Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@youderian](https://meta.discourse.org/u/youderian)
#### Post date: [April 4, 2019, 4:26pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456/1 "2019-04-04T16:26:22Z")
If this is possible and I’m looking in the wrong spot please forgive me.
Would love to see the ability to choose Group X **can’t** see/reply/etc when creating a new category.
We have two groups of members: “Store Owners” and “Service Providers”, and have a category called “Only Visible to Store Owners” where the Store Owners can chat candidly about vendors without worry of them dropping in.
The problem is that occasionally a store owner will also be a service provider as well. Because they belong to both groups they’ll see the category that is suppose to be just for Store Owners.
It’d be great to let members of the group “Store Owner” see the category but ONLY if thy were not also a member of the “Service Provider” category.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [April 4, 2019, 4:52pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456/2 "2019-04-04T16:52:26Z")
Category security permissions can only be used to grant a group access to a category. The default setting for a category is to grant the group ‘everyone’ the ability to create, reply, and see the category.
It’s not possible to create a permission that denies a group access to a category. For your case this means that you can’t create a permission that would say that the group ‘Service Providers’ can _not_ see the ‘Only Visible to Store Owners’ category.
To accomplish what you are trying to do with the category, you would need to create a new group for store owners who are not service providers, and then give that group access to the category that you are trying to hide from service providers.
---
### Author:  [@youderian](https://meta.discourse.org/u/youderian)
#### Post date: [April 4, 2019, 5:14pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456/3 "2019-04-04T17:14:16Z")
Thanks for your reply!
> [@simon](#):
>
> To accomplish what you are trying to do with the category, you would need to create a new group for store owners who are not service providers, and then give that group access to the category that you are trying to hide from service providers.
While we could theoretically do this it’d be pretty impractical for a number of reasons. Adding the “can’t see” logic to category permissions would be much simpler which is why I was adding it as a feature request.
Understand it may not be useful to others or make sense to prioritize but wanted to toss it out there as something that’d be useful to me at least if implemented.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [April 4, 2019, 9:56pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456/4 "2019-04-04T21:56:15Z")
> [@simon](#):
>
> It’s not possible to create a permission that denies a group access to a category.
Are there any specific reasons why this is so or why it can’t be changed?
I can see several use cases for the proposed “can’t see” setting. They basically amount to simplicity and security: the more groups you have (and the more people can control membership of those groups), the more difficult ot becomes to keep track of who has access to what. If there are certain categories to which certain people should absolutely not have access, the simplest and safest solution is to put those people into a group and exclude them from the respective categories via the “can’t see” settings.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [April 4, 2019, 10:22pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456/5 "2019-04-04T22:22:02Z")
> [@youderian](#):
>
> While we could theoretically do this it’d be pretty impractical for a number of reasons. Adding the “can’t see” logic to category permissions would be much simpler which is why I was adding it as a feature request.
Simpler for your use case (because it negates the need to manage user groups in more detail) but vastly more complicated for anyone else implementing permissions. There’s a good reason that Discourse takes the ‘deny by default’ approach and doesn’t insist on ordering rules - because lots of products in the past have attempted this, and their support forums are littered with examples of users having problems.
Your best solution would be to insert an IdM into the equation and manage your groups properly.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 4, 2019, 10:27pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456/6 "2019-04-04T22:27:24Z")
Many duplicates on this.
> [@New category permission - "cannot see"/"exclude"](https://meta.discourse.org/t/new-category-permission-cannot-see-exclude/50044):
>
> Continuing the discussion from [Suspend as way to expire membership](https://meta.discourse.org/t/suspend-as-way-to-expire-membership/49955/3): After suggesting to another user that instead of suspending a user they could put them in a group and change category permissions. I recently came across my own use case for this, where I needed to add some users to my instance and only give them access to one category. It does not seem like there is an easy way to do so, without modifying the permissions for every other category, and putting all other users in their own grou…
> [@Negative group permissions](https://meta.discourse.org/t/negative-group-permissions/79576/2):
>
> Make a shadow group that excludes the users is the best you can do now.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 4, 2019, 10:27pm UTC](https://meta.discourse.org/t/add-cant-see-logic-to-category-permissions/113456/7 "2019-04-04T22:27:28Z")