DocumentationExperience Cloud KCS

Configuring ABAC rules for metadata-based asset visibility in AEM Assets Content Hub

Last update: September 11, 2026

This article explains how to configure Attribute-Based Access Control (ABAC) rules in Adobe Experience Manager (AEM) Assets Content Hub to restrict asset visibility for a user group based on a specific metadata property value.

Description description

Environment

Adobe Experience Manager (AEM) Assets Content Hub

Symptoms

A user group should only be able to view assets where the metadata property asset-src = Brand Assets. Assets with asset-src values of Templates or Campaign Assets must not be visible to this group. Attempts to configure ABAC rules with incorrect value casing or multiple overlapping rules resulted in either too few assets being shown, or all assets being visible, including those that should be restricted. No error messages were displayed, but the rule didn’t filter assets as intended.

Cause

The issue was caused by incorrect value matching in the ABAC rule (case sensitivity and string format) and the presence of multiple overlapping rules, which resulted in unintended asset visibility.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Verify the exact metadata values stored for the asset-src property on your assets:

    • In AEM, open the asset properties for a sample asset you want to restrict (For example: a Brand Asset).

    • Locate the asset-src field under the asset’s metadata, and note the exact value (For example: Brand Assets).

    • Repeat for assets you want to restrict (For example: Templates, Campaign Assets) to confirm their values.

  2. Remove any existing ABAC rules for the user group to prevent conflicts:

    • In the Content Hub admin interface, navigate to the ABAC rules section for the relevant user group.

    • Delete all existing rules for this group.

  3. Create a single ALLOW rule for the group:

    • Add a new ABAC rule with the following parameters:

    • Resource Type: ASSET

    • Subject Condition: subjectGroup (select the relevant user group)

    • Resource Condition:

    • Condition Type: resourceAttribute

    • Attribute: ./metadata/asset-src

    • Operator: EQUALS

    • Value: Brand Assets (use the exact value as confirmed in step 1)

    • Environment Condition: global

    • Grants: READ

    Example rule (replace with your actual group identifier):

    code language-none 
    {            "resourceType": "ASSET",            "subjectCondition": {            "conditionType": "subjectGroup",            "groupName": ""            },            "resourceCondition": {            "conditionType": "resourceAttribute",            "attribute": "./metadata/asset-src",            "operator": "EQUALS",            "value": "Brand Assets"            },            "environmentCondition": { "conditionType": "global" },            "grants": [ "READ"]             }

  4. Save and apply the rule.

  5. Validate asset visibility:

    • Log in as a user in the restricted group.

    • Confirm that only assets with asset-src = Brand Assets are visible.

    • Ensure that assets with asset-src = Templates or Campaign Assets aren’t visible to this group.

recommendation-more-help
experience-cloud-kcs-help-kbarticles