---
title: Folder access recipes
description: "Ready-made rule sets you can copy into a role, covering a read-only archive, a shared team folder, a private area, and other common setups."
section: Access
order: 60
audience: [owner, admin]
status: published
lastVerified: 2026-09-15
sources:
  - src/lib/permissions.ts
  - web/src/components/app/permissions/RuleTable.tsx
  - src/objects/routes/objects.ts
---

Each recipe is a set of rules for one custom role. Build it on the **Roles** page, then give the role to the people who need it. In the tables, "Bucket" and "Prefix" are what you pick or type in the role editor; the connection is whichever one holds the bucket.

Test every new role with someone who isn't an Owner. Owners can reach everything, so everything always looks fine to them.

## Read-only access to a whole bucket

| Effect | Bucket | Prefix | Read | Write |
| --- | --- | --- | --- | --- |
| Allow | `archive` | | ✓ | |

They can browse, preview, download, and share anything in `archive`, but can't change it.

## A team folder

| Effect | Bucket | Prefix | Read | Write |
| --- | --- | --- | --- | --- |
| Allow | `shared` | `design-team/` | ✓ | ✓ |

When they open `shared`, they see only the `design-team/` folder, and they can do anything inside it, including deleting.

## A drop folder for someone outside the team

| Effect | Bucket | Prefix | Read | Write |
| --- | --- | --- | --- | --- |
| Allow | `clients` | `acme/incoming/` | ✓ | ✓ |
| Allow | `clients` | `acme/deliveries/` | ✓ | |

The client can upload to `incoming/` and download what you put in `deliveries/`, but can't change your deliveries.

## Everything except one private folder

| Effect | Bucket | Prefix | Read | Write |
| --- | --- | --- | --- | --- |
| Allow | `finance` | | ✓ | ✓ |
| Deny | `finance` | `payroll/` | ✓ | ✓ |

They can use all of `finance` except `payroll/`, which doesn't even appear in their file list. Because Deny always wins, no other role they have can reopen it.

## Several roles for one person

People can have more than one role. Their access is everything their roles allow, minus anything any of their roles deny. So a person with the "Team folder" role and the "Read-only archive" role gets both.

When a combination behaves unexpectedly, look for a Deny in any of their roles first.

## A role for an AI client

Make a small role with only what the AI client needs, like Read on `exports/approved/`. Give it to the person who'll connect the client, and have them pick only that role when they [approve the client](/docs/agents/consent/). Don't hand an AI client a broad role just because it's convenient.

## Prefix reminders

- A prefix covers the folder and everything inside it.
- `team/` doesn't cover `team-old/`.
- Slashes at the start and end don't matter, but capital letters do: `Team/` isn't `team/`.