---
title: Why can't I do this?
description: "Work out why someone can't see a bucket, open a folder, upload, or delete, by checking organisation, roles, rules, and the access key in order."
section: Troubleshooting
order: 30
audience: [owner, admin, member]
status: published
lastVerified: 2026-09-15
sources:
  - src/lib/permissions.ts
  - src/objects/routes/dashboard.ts
  - src/objects/routes/objects.ts
  - src/objects/organisation.constants.ts
---

If you're a Member, send this page to an Owner or Admin along with what you were trying to do, and where. They can check the steps below.

## Check these in order

1. **The right organisation?** Look at the switcher at the top right. Roles only apply in their own organisation.
2. **An Owner?** Owners can do everything. If an Owner can't, the problem is the connection, not roles: see [connection problems](/docs/troubleshooting/connections/).
3. **A custom role that allows it?** Open **People** and look at their **Access** column. "No access" means none of their roles has an Allow rule. Admin doesn't count; it gives no file access.
4. **The right permission?** Browsing, previewing, downloading, and sharing need **Read**. Uploading, deleting, and new folders need **Write**.
5. **The right place?** The rule has to name the same connection, bucket, and folder. `team/` doesn't cover `team-old/`, and `Reports/` isn't `reports/`.
6. **A Deny somewhere?** Check every role they have. One Deny wins over any number of Allows.
7. **Inside the connection's bucket scopes?** Buckets left out of **Bucket scopes** are hidden from everyone.
8. **Allowed by the storage key?** If the key behind the connection can't do it, nobody can.

The quickest way to see what happened: open **Audit log**, filter by the person's user ID and **Denied**. Each row shows the exact bucket and path that was refused.

## Things that look like bugs but aren't

- **A denied folder just isn't there.** quickS3 hides folders you can't read instead of showing an error.
- **Write without Read hides the bucket.** Overview only lists buckets you can read. Give Read along with Write.
- **A new role doesn't seem to work.** Changes apply to the next action, but an open page may show the old list. Select **Refresh**.
- **It works for me but not for them.** If you're an Owner, you skip role checks. Test roles with someone who isn't.

## Checking a fix

Ask the person to try three things: something that should work, something next to it that shouldn't, and the thing that failed before. Then check the audit log shows Allowed and Denied where you expect.