Is it possible to revoke access of item from all roles at once without looping?

Question

Consider below case for this example.

Content Tree:

 
Home  
    A1  
        A1B1  
            A1B1C1  
            A1B1C2  
        A1B2  
    A2  

Roles:
RoleA1 - Having access of item A1 and descendants.
RoleA1B1 - Having access of item A1B1 and descendants.

Now, when i create a role RoleA1B1C1 having access of item A1B1C1 and descendants, I want to remove access of this item (A1B1C1) from all other roles like RoleA1, RoleA1B1 etc. without modifying/looping those roles. (Reason not touching those role is number of roles can be in hundreds or thousands).

Answer 1

So you want item A1B1C1 to only be accessible by RoleA1B1C1? First thing would be this, I'm assuming that RoleA1B1C1 is inheriting RoleA1B1, and then RoleA1B1 is inheriting RoleA1. Otherwise, depending on your other security, RoleA1B1C1 might not be able to see the ancestor items.

So there's a few assumptions going into this, but if I understand your scenario:

1. In the Security section for the item, add the Everyone role and set the Inheritance settings to Deny on Item/Descendants.

2. Then add the RoleA1B1C1 role and grant Read to Item/Descendants. Note for a quick example, I'm using the sitecore\Developer role, but use your custom role here.

This breaks the inheritance chain so that you have to be a member of that one role to access the item, without explicitly locking out the other roles. If you explicitly deny the other roles, anyone in both RoleA1 and RoleA1B1C1, for example, would be denied access to the item. This way, if someone's crossing roles, they'll have access to the appropriate content.