The Islandora XACML Editor provides a graphical user interface to edit XACML policies for objects in a repository or collection. It adds a new section in the Manage tab for each object and collection called Object Policy where permissions can be granted to Drupal users or roles for the following:
Object Management: Controls ability to view the options on the Manage tab for objects or collections.
Drupal.org modules:
Install as usual, see this for further information.
Using the Object Policy tab to manage access restrictions with XACML
Configuration options for the Islandora XACML Editor and Islandora XACML API are available at admin/islandora/tools/xacml
Save Relationships - Checking this box will update the RELS-EXT datastream with usernames and roles whenever a POLICY datastream is updated. Writing these relationships into the RELS-EXT is required in order to remove view-restricted objects and datastreams from any display that uses Solr search results.
If you want to grant access in Drupal for users without the "administrator" role to edit XACML policies, you will have to remove one of the default XACML policies applied globally at the Fedora Commons level which denies any interactions with the POLICY datastream to users without the "administrator" role.
This policy is located here: $FEDORA_HOME/data/fedora-xacml-policies/repository-policies/default/deny-policy-management-if-not-administrator.xml
See the Islandora Deployments GitHub repository for more examples of customized global XACML policies in Islandora's Fedora Commons.