# ACL for Mobileforce Screens

- Published on Jan 29, 2026
- 1 minute(s) read
- MS

Mobileforce Screens can be made visible or hidden, and further access controlled by using a logical combination of access control roles that can be created either in Mobileforce itself or inherited from an external system of record such as a CRM or an ERP.

An access control role represents a group of users all of whom have the same access level.

The simplest form of ACL role is a group of users. For instance

acl="ec-Admin" refers to the group of users who fall in the "ec-Admin" role of the external system of record. This way, one can map external roles to Mobileforce ACLs.

ACL roles can be combined using logical expressions. For instance acl="!ec-Admin" (notice the "!" sign which signifies NOT) is the complement of the previous ACL "ec-Admin": i.e., any user who is NOT in the role "ec-Admin"

Further combinations of logical operations such as AND (,) and OR (|) are also permitted., For instance:

Code snippet

```none
```

A screen can represent an entire table (often from a 3rd party system of record). In this case, one can specify who has access to various operations on the table as follows

Code snippet

```none
<screen acl="ec-Admin">...
   <data>
            <prop key="param-prefix">easyclm-</prop>
            <prop key="easyclm-table">Account</prop>
            <prop key="easyclm-scope-Account" acl="ec-Admin">scopeAll</prop>
            <prop key="table-filters">adlform_User_id = '${user.user_id}'"|My Accounts|name!=""|All Accounts</prop>
            <prop key="table-actions">create,read,update,delete,list</prop>
     </data>
</screen>
```

The above specification indicates that a table called "Account" comes from the namespace easyclm (think of the name space as an external system). The table-actions prop key describes what actions can be taken on the Accounts table, in this case the actions allowed are CRUD (Create, Read, Update, Delete) i.e., all actions.

It also indicates that the scope of who can access this Account table is "scopeAll" i.e., anyone can access it.

However, a subsequent table filter.