---
title: "Backend module access gates"
manual: "TYPO3 Explained"
version: "14.3"
permalink: "https://docs.typo3.org/permalink/t3coreapi:backend-module-access-gates@14.3"
source: "ApiOverview/Backend/BackendModules/AccessGates.rst"
rendered: "2026-09-20T16:07:38+00:00"
---

# Backend module access gates {#backend-module-access-gates}

<!-- TODO: no Markdown rendering for "versionadded" -->

Existing backend module registrations using the built-in access values continue
to work without modification:useradminsystemMaintainer

The TYPO3 backend module system supports configurable access control through
**module access gates**. Gates determine whether a backend user may access a
specific backend module.

TYPO3 provides built-in gates for common access strategies and allows extension
authors to register custom gates for project-specific requirements.

**Table of contents**

-   [Built-in access gates](https://docs.typo3.org/permalink/t3coreapi:built-in-access-gates@14.3)
-   [Register a custom access gate](https://docs.typo3.org/permalink/t3coreapi:register-a-custom-access-gate@14.3)
-   [Gate evaluation order](https://docs.typo3.org/permalink/t3coreapi:gate-evaluation-order@14.3)

## Built-in access gates {#backend-module-access-gates-built-in-gates}

TYPO3 ships the following built-in access gates:

-   `\TYPO3\CMS\Backend\Module\AccessGate\UserGate`
    (`'access' => 'user'`)
-   `\TYPO3\CMS\Backend\Module\AccessGate\AdminGate`
    (`'access' => 'admin'`)
-   `\TYPO3\CMS\Backend\Module\AccessGate\SystemMaintainerGate`
    (`'access' => 'systemMaintainer'`)

These gates preserve the traditional backend module access behavior.

### `UserGate` {#backend-module-access-gates-user-gate}

The `UserGate` grants access to:

-   Backend administrators
-   Backend users or groups with explicit module permissions configured in:

    -   `be_users.userMods`
    -   `be_groups.groupMods`

This corresponds to the module access value:

```php
'access' => 'user',
```

### `AdminGate` {#backend-module-access-gates-admin-gate}

The `AdminGate` grants access only to backend administrator users.

This corresponds to:

```php
'access' => 'admin',
```

### `SystemMaintainerGate` {#backend-module-access-gates-system-maintainer-gate}

The `SystemMaintainerGate` grants access only to system maintainers.

This corresponds to:

```php
'access' => 'systemMaintainer',
```

## Register a custom access gate {#backend-module-access-gates-register-custom-gates}

Extension authors can implement custom access strategies by creating a class
that implements
`\TYPO3\CMS\Backend\Module\ModuleAccessGateInterface`.

Custom gates are registered using the
`#[AsModuleAccessGate]` PHP attribute.

The gate must return a
`\TYPO3\CMS\Backend\Module\ModuleAccessResult` value.

Possible results are:

-   `ModuleAccessResult::Granted`
-   `ModuleAccessResult::Denied`
-   `ModuleAccessResult::Abstain`

### Example: custom editor gate {#backend-module-access-gates-example-editor-gate}

**EXT:examples/Classes/Module/AccessGate/ExampleGate.php**

```php
<?php

declare(strict_types=1);

namespace T3docs\Examples\Module\AccessGate;

use TYPO3\CMS\Backend\Module\ModuleAccessGateInterface;
use TYPO3\CMS\Backend\Module\ModuleAccessResult;
use TYPO3\CMS\Backend\Module\ModuleInterface;
use TYPO3\CMS\Core\Attribute\AsModuleAccessGate;
use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;

#[AsModuleAccessGate(identifier: 'exampleUser')]
class ExampleGate implements ModuleAccessGateInterface
{
  public function decide(
    ModuleInterface $module,
    BackendUserAuthentication $user,
  ): ModuleAccessResult {
    if ($module->getAccess() !== 'exampleUser') {
      return ModuleAccessResult::Abstain;
    }
    $userTsConfig = $user->getTSConfig();
    $exampleUserGroupId = (int)($userTsConfig['options.']['example.']['userGroup'] ?? 0);
    $permission = $user->isAdmin() || in_array($exampleUserGroupId, $user->userGroupsUID);
    return $permission
        ? ModuleAccessResult::Granted
        : ModuleAccessResult::Denied;
  }
}

```

The example above defines a custom access type called `exampleUser`.

The gate only handles modules whose `access` option is set to
`exampleUser`. For all other modules, it returns
`ModuleAccessResult::Abstain`.

The gate accesses information about the currently authenticated backend user
through the
`BackendUserAuthentication`
object passed to the `decide()` method.

This allows custom gates to implement project-specific permission logic based
on user groups, user TSconfig settings, workspace access, user preferences, or other
backend user properties.

After registering the gate, use its identifier in the module configuration.

**EXT:my_extension/Configuration/Backend/Modules.php (excerpt)**

```php
<?php

declare(strict_types=1);

return [
  'my_module' => [
    'access' => 'exampleUser',
    'labels' => 'examples.module.content_examples_clipboard',
    // ...
  ],
];

```

## Gate evaluation order {#backend-module-access-gates-evaluation-order}

Multiple gates can be registered simultaneously.

The `before` and `after` options of the
`#[AsModuleAccessGate]` attribute define the evaluation order.

**EXT:examples/Classes/Module/AccessGate/ExampleGate.php (excerpt)**

```php
use TYPO3\CMS\Backend\Module\ModuleAccessGateInterface;
use TYPO3\CMS\Core\Attribute\AsModuleAccessGate;

#[AsModuleAccessGate(
    identifier: 'exampleUser',
    after: ['user'],
)]
final readonly class ExampleGate implements ModuleAccessGateInterface
{
    // ...
}
```