---
title: Admin quickstart
description: "Create a role that grants one folder, invite a teammate into it, and check what they can reach. The order matters, so build the role first."
section: Start here
order: 30
audience: [admin, owner]
status: published
lastVerified: 2026-09-15
sources:
  - web/src/components/app/permissions/CreateRoleDialog.tsx
  - web/src/components/app/permissions/RoleDetail.tsx
  - web/src/components/app/permissions/RuleTable.tsx
  - web/src/components/app/permissions/InviteDialog.tsx
  - web/src/components/app/permissions/PeopleList.tsx
  - web/src/components/app/permissions/helpers.ts
  - src/objects/organisation.constants.ts
---

In quickS3, nobody can open a bucket until a role says they can. This guide sets up one teammate from scratch: you build the role first, then invite them into it. Doing it in that order means you decide exactly what they get before they ever sign in, and the next person who needs the same access gets the same role.

You need to be an Owner or an Admin, and at least one storage connection has to exist. If there isn't one yet, an Owner starts with [Connect your first bucket](/docs/get-started/owner/).

## 1. Create the role

1. Open **Roles** and select **Create role**.
2. Pick a starting point. For a teammate who should work in one folder, choose **Uploader**. It creates a single rule you can narrow down.
3. Give the role a name that says what it's for, like "Finance reports", and select **Create role**.

<figure>
  <img src="/docs/screenshots/v1.3.2/custom-role-templates-light.png" alt="Create a role dialog with four starting points: Read-only, Uploader, Full access, and Start empty, each with a one-line description." width="992" height="511" loading="lazy" />
  <figcaption>Read-only and Full access add a rule for every bucket that exists right now. Uploader adds one rule you then point at the right place.</figcaption>
</figure>

The role editor opens with the template's rules filled in but not saved yet. Check each rule before you save:

- **Connection** and **Bucket**: where the rule applies.
- **Prefix**: the folder inside the bucket, for example `reports/`. Leave it empty to cover the whole bucket.
- **Read** lets them browse, preview, download, and share files. **Write** lets them upload, and also overwrite, delete, and create folders.

<figure>
  <img src="/docs/screenshots/v1.3.2/role-editor-prefix-rule-light.png" alt="Role editor with one Allow rule on the S3 Files Shared connection, bucket public, prefix reports/, with Read and Write both ticked, and the Save role and Discard changes buttons." width="1458" height="606" loading="lazy" />
  <figcaption>One rule: read and write, but only inside <code>reports/</code> in the <code>public</code> bucket.</figcaption>
</figure>

4. Select **Save role**.

## 2. Invite your teammate

1. Open **People** and select **Invite**.
2. Enter their email address.
3. Tick the role you just made. Tick **Admin** as well only if they should help run the organisation (it gives no file access on its own).
4. Select **Send invite**.

<figure>
  <img src="/docs/screenshots/v1.3.2/invite-dialog-light.png" alt="Invite a teammate dialog with alex@example.com in the Email field, Admin unticked, Finance reports ticked, and the Send invite button." width="792" height="592" loading="lazy" />
  <figcaption>Tick the role you built. Leave Admin unticked unless they'll help manage people and roles.</figcaption>
</figure>

They get an email with a link. Until they accept, they show in the People list as **Invited**, and you can select **Cancel invite** to withdraw it. An invitation expires after seven days; if that happens, invite them again.

## 3. Check what they can reach

Once they accept, their row turns **Active**, and the **Access** column sums up their roles, for example "Read & write · 1 rule across 1 bucket". If it says **No access**, they have no role with an Allow rule yet: select their roles and tick one, then **Save**.

To confirm it works from their side, ask them to open **Overview**. They should see only the bucket in your rule. When they open it, the top level shows just the `reports/` folder, and everything outside it stays hidden. Anything they do is recorded in the [audit log](/docs/audit/overview/).

## Things that catch people out

### Write includes delete

There's no upload-only permission. A role called "Uploader" with Write on a whole bucket lets that person delete anything in it. Narrow Write to a prefix when you can.

### Admin isn't file access

Admins manage people and roles, but they can't open a bucket unless one of their roles grants it. Only Owners can reach everything.

### Deny always wins

If any of someone's roles has a Deny rule, an Allow in another role won't undo it. Remove or narrow the Deny instead. [Allow and deny rules](/docs/access/rules/) explains how rules combine.