# Destination-Level Permissions

Administrators can be granted permissions on each destination. Destination-level permissions control the administration functions a user can perform on a specific destination. Global permissions granted to a user override any destination-level permissions.

The typical use of destination-level administration permissions is to specify permissions on wildcard destinations for different groups of users. This allows you to specify particular destinations over which a group of users has administrative control. For example, you may allow one group to control all `ACCOUNTING.*` topics, and another group to control all `PAYROLL.*` queues.

The following table describes the destination-level administration permissions.

Permission | Allows Administrator To...
--- | ---
`view` | View information for this destination.
`create` | Create the specified destination. This permission is useful when used with wildcard destination names. This allows the user to create any destination that matches the specified parent.
`delete` | Delete this destination.
`modify` | Change the properties for this destination.
`purge` | Either purge this queue, if the destination is a queue, or purge the durable subscribers, if the destination is a topic with durable subscriptions.

Note: Any type of modification to an item requires that the user can view that item. Therefore, granting create, modify, delete, change, or purge implicitly grants the permission to view the associated item.

Granting the view permissions is useful when you want specific users to only be able to view items. It is not necessary to grant the view permission if a user already has a permission that allows the user to modify the item.

Administration permissions for a destination are stored alongside all other permissions for the destination in the `acl.conf` file. For example, if user `BOB` has publish and subscribe permissions on topic `foo`, and then `BOB` is granted view permission, the acl listing would look like the following:

    TOPIC=foo USER=BOB PERM=publish,subscribe,view

Note: Both user and administrator permissions for a destination are stored in the same entry in the acl.conf file. This is for convenience rather than for clarity. User permissions specify the actions a client application can perform on a destination (publish, subscribe, send, receive, and so on). Administrator permissions specify what administrative commands the user can perform on the destination when using the administration tool or API.
Copyright © Cloud Software Group, Inc. All rights reserved.