Who can do what

In the organisation

	Owner	Admin	Member
Open files	Everything	What their custom roles allow	What their custom roles allow
Invite people and cancel invitations	Yes	Yes	No
Change Members’ and Admins’ roles, remove them	Yes	Yes	No
Make someone Owner, or remove an Owner	Yes	No	No
Create, edit, and delete custom roles	Yes	Yes	No
See the audit log	Yes	Yes	No
Test connections	Yes	Yes	No
Add, edit, and delete connections	Yes	No	No
Create buckets	Yes	No	No
Rename the organisation	Yes	No	No
Connect and revoke their own AI clients	Yes	Yes	Yes
See and revoke everyone’s AI clients	Yes	Yes	No
Leave the organisation from People	Yes, unless the last Owner	Yes	No, ask an Owner or Admin

File actions

Action	Needs
See a bucket on Overview, browse, preview, download	Read
Create a share link	Read
Upload, overwrite, create folders, delete	Write

Owners don’t need rules. For everyone else, at least one Allow rule must match and no Deny rule in any of their roles. The connection’s bucket scopes and the storage key can limit things further, for everyone.

Outside the organisation

Someone with a share link can download that one file until the link expires, without an account. The link stops working early if the person who created it loses Read on the file or leaves the organisation.

An AI client can do what the roles its user approved allow, until the access expires or is revoked. With Read it can list and create download and share links; with Write it can upload. It can never delete, create folders, or manage anything. Links it creates stop working when its access ends.