---
title: Who can do what
description: "A single table of what Owners, Admins, Members, share-link recipients, and AI clients can each do in an organisation and with your files."
section: Reference
order: 40
audience: [owner, admin, member, agent-user]
status: published
lastVerified: 2026-09-15
sources:
  - src/objects/organisation.constants.ts
  - web/src/components/app/AppNav.tsx
  - web/src/components/app/permissions/PeopleList.tsx
  - src/mcp/server.ts
  - src/objects/routes/objects.download.ts
---

## In the organisation

| | Owner | Admin | Member |
| --- | --- | --- | --- |
| Open files | Everything | What their custom roles allow | What their custom roles allow |
| Invite people and cancel invitations | Yes | Yes | No |
| Change Members' and Admins' roles, remove them | Yes | Yes | No |
| Make someone Owner, or remove an Owner | Yes | No | No |
| Create, edit, and delete custom roles | Yes | Yes | No |
| See the audit log | Yes | Yes | No |
| Test connections | Yes | Yes | No |
| Add, edit, and delete connections | Yes | No | No |
| Create buckets | Yes | No | No |
| Rename the organisation | Yes | No | No |
| Connect and revoke their own AI clients | Yes | Yes | Yes |
| See and revoke everyone's AI clients | Yes | Yes | No |
| Leave the organisation from **People** | Yes, unless the last Owner | Yes | No, ask an Owner or Admin |

## File actions

| Action | Needs |
| --- | --- |
| See a bucket on Overview, browse, preview, download | Read |
| Create a share link | Read |
| Upload, overwrite, create folders, delete | Write |

Owners don't need rules. For everyone else, at least one Allow rule must match and no Deny rule in any of their roles. The connection's bucket scopes and the storage key can limit things further, for everyone.

## Outside the organisation

**Someone with a share link** can download that one file until the link expires, without an account. The link stops working early if the person who created it loses Read on the file or leaves the organisation.

**An AI client** can do what the roles its user approved allow, until the access expires or is revoked. With Read it can list and create download and share links; with Write it can upload. It can never delete, create folders, or manage anything. Links it creates stop working when its access ends.