Folder access recipes
Ready-made rule sets you can copy into a role, covering a read-only archive, a shared team folder, a private area, and other common setups.
Each recipe is a set of rules for one custom role. Build it on the Roles page, then give the role to the people who need it. In the tables, “Bucket” and “Prefix” are what you pick or type in the role editor; the connection is whichever one holds the bucket.
Test every new role with someone who isn’t an Owner. Owners can reach everything, so everything always looks fine to them.
Read-only access to a whole bucket
| Effect | Bucket | Prefix | Read | Write |
|---|---|---|---|---|
| Allow | archive | ✓ |
They can browse, preview, download, and share anything in archive, but can’t change it.
A team folder
| Effect | Bucket | Prefix | Read | Write |
|---|---|---|---|---|
| Allow | shared | design-team/ | ✓ | ✓ |
When they open shared, they see only the design-team/ folder, and they can do anything inside it, including deleting.
A drop folder for someone outside the team
| Effect | Bucket | Prefix | Read | Write |
|---|---|---|---|---|
| Allow | clients | acme/incoming/ | ✓ | ✓ |
| Allow | clients | acme/deliveries/ | ✓ |
The client can upload to incoming/ and download what you put in deliveries/, but can’t change your deliveries.
Everything except one private folder
| Effect | Bucket | Prefix | Read | Write |
|---|---|---|---|---|
| Allow | finance | ✓ | ✓ | |
| Deny | finance | payroll/ | ✓ | ✓ |
They can use all of finance except payroll/, which doesn’t even appear in their file list. Because Deny always wins, no other role they have can reopen it.
Several roles for one person
People can have more than one role. Their access is everything their roles allow, minus anything any of their roles deny. So a person with the “Team folder” role and the “Read-only archive” role gets both.
When a combination behaves unexpectedly, look for a Deny in any of their roles first.
A role for an AI client
Make a small role with only what the AI client needs, like Read on exports/approved/. Give it to the person who’ll connect the client, and have them pick only that role when they approve the client. Don’t hand an AI client a broad role just because it’s convenient.
Prefix reminders
- A prefix covers the folder and everything inside it.
team/doesn’t coverteam-old/.- Slashes at the start and end don’t matter, but capital letters do:
Team/isn’tteam/.