File and Folder Permissions

Permissions in the Files plugin control who sees the contents of folders, who can upload and edit files, and who can delete. Permissions are set at the folder level and can be inherited down the folder tree.

When to use this

• You want to limit certain folders to a specific user group
• Different apps should have different access rules for the same file archive
• A single file should have permissions different from the rest of the folder
• You want everyone to read but only one group to write

How it works

Permissions have three layers that combine:

1. Permissions for all users — generic defaults for the folder.
2. Permissions per user/user group — granular rules for specific people or groups.
3. Permissions per app — rules that only apply in a specific app.

Each rule is a combination of three toggles:

Permission	Description
Allow read	The user can see the folder and its files.
Allow write	The user can create subfolders, upload files, and edit file properties.
Allow delete	The user can delete folders and files.

Find permissions

1. Open the folder in the file archive.
2. Click the gear icon → Permissions.

You'll see three sections:

• Permissions for all users — defaults.
• Users and user groups — granular list where you add specific permissions.
• Advanced → Permissions per app — rules per app.

Permissions for all users

Toggle Allow read, Allow write, and Allow delete to set the defaults. These apply to every user who doesn't have an explicit granular rule.

TIP

For restricted folders — start by turning everything off here and then add specific groups with read access in the granular list. It's easier to audit than to remember what the default grants.

Permissions per user and user group

To grant a specific user or group different access:

1. Open Permissions → Permissions for user groups (or Permissions for users).
2. Click Add.
3. Pick the user or group.
4. Set Allow read, Allow write, and Allow delete.
5. Save.

Granular permissions take precedence over Permissions for all users.

TIP

Use user groups rather than individual users when possible. When someone changes role you update the group membership — not every folder's permissions.

Permissions per app

You can give a folder different permissions in different apps via Permissions per app. That's useful when the same folder should behave differently depending on where it's shown:

• Read-only in a public app, but editable in an internal admin app.
• Completely hidden in a partner app.
• Upload allowed only in a specific app.

Inherit permissions

When you set permissions on a parent folder, they apply by default to subfolders and files. If a subfolder has its own permissions, those replace the parent's rules — otherwise the parent's rules cascade down.

TIP

Think top-down. Set strict permissions at the root and loosen them step by step on subfolders that need more open access. That's safer than trying to revoke access on individual subfolders.

Per-file permissions

Click a file → Permissions to set file-specific rules. The structure is identical to folder permissions — Allow read, Allow write, and Allow delete with support for per-user, per-group, and per-app.

File-specific permissions take the highest precedence and override the folder. Use them sparingly — it's easy to lose control at the folder level if too much is overridden per file.

Advanced combinations

When a user belongs to several groups with different permissions on the same folder, the rights are summed — the user gets the highest level granted by any of their groups.

The list marks folders and files with advanced permissions when they have a mix of rules across layers. The toggles in the generic view appear disabled — you have to open each user or group to see the exact rules.

Delete permissions

To remove a granular permission:

1. Open the permission in the list.
2. Scroll to Delete permissions.
3. Click Delete.

That user or group then falls back to Permissions for all users.

Permission examples

Open folder readable by everyone

1. Permissions for all users → turn on Allow read.
2. Permissions for user groups → add Content editors with Allow write and Allow delete.

Everyone sees the folder, but only editors can upload and delete.

Private folder for a department

1. Permissions for all users → turn off everything.
2. Permissions for user groups → add HR with Allow read, Allow write, and Allow delete.

Only HR sees the folder and its content. For everyone else, the folder is invisible.

Folder where everyone can upload but only admins delete

1. Permissions for all users → turn on Allow read and Allow write.
2. Permissions for user groups → add Administrators with Allow delete in addition.

Every employee can see and upload files, but only administrators can delete.

Files shown differently in different apps

1. On the folder, Permissions per app → pick the internal admin app → Allow read, Allow write, Allow delete.
2. On the same folder, Permissions per app → pick the customer app → only Allow read.

Internally, admins can manage the files freely; in the customer app the files are read-only.

Tips

TIP

Structure folders by permission needs, not by content type. Internal/, Public/, and External/ as root folders make it easier to set correct access than mixing different sensitivity levels in the same structure.

TIP

For files that should be shareable externally — copy the file's Path and share it. The URL still respects permissions, so only users with read access can fetch the file.

Common mistakes

WARNING

Granular permissions don't replace Permissions for all users — they sit on top. To block a group you have to both turn it off in the generic setting and leave it blank in the group setting.

WARNING

File-specific permissions override the folder's rules. It's easy to lose track — only use them when really needed and document the exceptions.

WARNING

Permissions on a parent folder cascade by default, but if a subfolder has its own permissions, the parent's rules are replaced entirely. Think about what happens when you set permissions on subfolders — it can lock out parent roles.

WARNING

Permissions per app apply on top of the other rules. A user must have access at both the user level and the app level to see the file. Forgetting to set up app permissions makes the folder invisible in that specific app even if generic permissions allow access.