> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/users-and-permissions/folder-permissions.md).

# Folder Permissions

Folder permissions control which folders a user can access and what the user can do inside them. They apply to normal ExaVault installations, where administrators grant access to folders in one shared file system.

Sites using [HyperPrivacy Mode](/hyperprivacy-mode.md) have a different model. Each user has a separate file system, and access between users is granted through [Sharing](/hyperprivacy-mode/sharing.md) instead of the folder permissions described here.

## Home Directories Set the Access Boundary

Each user has a Home Directory that becomes the user's virtual root. The user cannot browse above that directory, and permissions can only expose folders inside it.

Set the Home Directory to the narrowest location that contains everything the user needs. Use folder permissions within that boundary to control individual operations.

## Permission Types

An access rule grants one or more permissions on a folder. The web interface uses these names:

| Permission        | What It Allows                                                                                                                                                    |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| *Show Contents*   | Lists the files and subfolders in the folder. Without this permission, an upload-only user can access the assigned folder but does not see its existing contents. |
| *Download (Read)* | Opens or downloads files. Selecting this permission also grants *Show Contents*.                                                                                  |
| *Upload (Write)*  | Uploads files, creates folders, and overwrites files. This permission does not grant *Show Contents* by itself.                                                   |
| *Delete*          | Deletes files or folders. Selecting this permission also grants *Show Contents*.                                                                                  |

The four permissions are independent except for the *Show Contents* behavior described above. A user can therefore receive upload-only access without download or delete access.

## How Permissions Combine

ExaVault permissions are additive grants. The effective permissions on a folder are the combination of every applicable rule:

* permissions granted directly to the user;
* permissions granted to any group the user belongs to; and
* permissions inherited from rules on parent folders within the user's Home Directory.

A direct user rule does not replace a group rule, and one group does not replace another group. A rule on a child folder also cannot remove access inherited from a parent. If any applicable rule grants a permission, the user receives it.

For example, suppose the `Vendors` group has *Show Contents* and *Download (Read)* on `/Projects`, while one user has *Upload (Write)* on `/Projects/Incoming`. That user can list, download, and upload within `/Projects/Incoming` because the parent group grant and the direct child-folder grant combine.

Normal ExaVault folder permissions do not include a deny rule. To remove a permission, change or remove every direct, group, or parent-folder rule that grants it.

## Permissions Required for Common Actions

Some operations need permissions on both the source and destination.

| Action                                              | Required Permissions                                                                   |
| --------------------------------------------------- | -------------------------------------------------------------------------------------- |
| Browse a folder                                     | *Show Contents* on the folder                                                          |
| Open or download a file                             | *Download (Read)* on the file's folder                                                 |
| Upload a file, create a folder, or overwrite a file | *Upload (Write)* on the destination folder                                             |
| Copy an item                                        | *Download (Read)* on the source and *Upload (Write)* on the destination                |
| Move or rename an item                              | *Download (Read)* and *Delete* on the source, plus *Upload (Write)* on the destination |
| Delete an item                                      | *Delete* on the folder containing the item                                             |

Because *Download (Read)* and *Delete* include *Show Contents*, you do not need to select *Show Contents* separately when either of those permissions is granted.

## Assign Folder Permissions

Administrators can manage access from either the user or group record. Open *Users*, open the action menu for the user or group, and select *Access*. Select the folder, then enable the permissions to grant on that folder.

You can also select a folder in *Files* and use *Access* to add or remove users and groups for that folder.

The interface prevents a delegated manager from granting a permission the manager does not have. An access rule must target a folder rather than a file and must grant at least one permission.

Use groups for access shared by several accounts, then reserve direct user rules for real exceptions. This keeps reviews manageable and reduces the chance that an old one-off rule continues granting access after a user's responsibilities change.

## Investigate Unexpected Access

When a user can do more than one visible rule appears to allow, review all sources of access. Check the user's direct rules, every group membership, and the rules on each parent folder. A narrower rule with fewer selected permissions does not cancel a broader grant.

When a user can upload but cannot see existing files, the account has *Upload (Write)* without *Show Contents*. This is the expected upload-only behavior.

For a failed move or rename, check both sides of the operation. The source requires *Download (Read)* and *Delete*, while the destination requires *Upload (Write)*.