How to allow users to edit experience fragments without allowing them to delete them

Go to http://host:port/crx/de/index.jsp and log in as admin.

Browse to and select the node /content/experience-fragments.

In the bottom right panel, select the Access Control tab.

Click the green plus icon to the right to add a new Access Control Policy (the policy already exists if you already see access control entries listed - in that case go on to the next).

Click the green plus icon that shows up after that to add a new Access Control Entry.

Enter a Principal which is the id of the group that you want to grant the access.

Enable the checkbox for jcr:read.

Expand Advanced, under rep:glob enter double quotes "".

Click OK.

Now, also using CRXDe, go to the desired sub-path under /content/experience-fragments, for example /content/experience-fragments/intuit.

In the bottom right panel select the Access Control tab.

Click the green plus icon to the right to add a new Access Control Policy (the policy already exists if you already see access control entries listed - in that case go on to the next step).

Click the green plus icon that shows up after that to add a new Access Control Entry.

Enter a Principal which is the id of the group that you want to grant the access.

Enable the checkbox for jcr:read and rep:write.

Click OK.

Click the green plus icon again to add another Access Control Policy.

Enter the same Principal name as in step 5.

Select Deny for the Type.

Expand Advanced and enable the checkboxes for jcr:removeChildNodes and rep:removeProperties.

Click the green plus icon that shows up after that to add a new Access Control Entry.

Enter a Principal which is the id of the group that you want to grant the access.

Expand Advanced and enable the checkboxes for jcr:removeChildNodes and rep:removeProperties.

Under rep:glob enter */jcr:content*.

Click OK.