Why can't I do this?

If you’re a Member, send this page to an Owner or Admin along with what you were trying to do, and where. They can check the steps below.

Check these in order

1. The right organisation? Look at the switcher at the top right. Roles only apply in their own organisation.
2. An Owner? Owners can do everything. If an Owner can’t, the problem is the connection, not roles: see connection problems.
3. A custom role that allows it? Open People and look at their Access column. “No access” means none of their roles has an Allow rule. Admin doesn’t count; it gives no file access.
4. The right permission? Browsing, previewing, downloading, and sharing need Read. Uploading, deleting, and new folders need Write.
5. The right place? The rule has to name the same connection, bucket, and folder. team/ doesn’t cover team-old/, and Reports/ isn’t reports/.
6. A Deny somewhere? Check every role they have. One Deny wins over any number of Allows.
7. Inside the connection’s bucket scopes? Buckets left out of Bucket scopes are hidden from everyone.
8. Allowed by the storage key? If the key behind the connection can’t do it, nobody can.

The quickest way to see what happened: open Audit log, filter by the person’s user ID and Denied. Each row shows the exact bucket and path that was refused.

Things that look like bugs but aren’t

• A denied folder just isn’t there. quickS3 hides folders you can’t read instead of showing an error.
• Write without Read hides the bucket. Overview only lists buckets you can read. Give Read along with Write.
• A new role doesn’t seem to work. Changes apply to the next action, but an open page may show the old list. Select Refresh.
• It works for me but not for them. If you’re an Owner, you skip role checks. Test roles with someone who isn’t.

Checking a fix

Ask the person to try three things: something that should work, something next to it that shouldn’t, and the thing that failed before. Then check the audit log shows Allowed and Denied where you expect.