Folder Permissions
Folder permissions control which folders a user can access and what the user can do inside them. They apply to normal ExaVault installations, where administrators grant access to folders in one shared file system.
Sites using HyperPrivacy Mode have a different model. Each user has a separate file system, and access between users is granted through Sharing instead of the folder permissions described here.
Home Directories Set the Access Boundary
Each user has a Home Directory that becomes the user's virtual root. The user cannot browse above that directory, and permissions can only expose folders inside it.
Set the Home Directory to the narrowest location that contains everything the user needs. Use folder permissions within that boundary to control individual operations.
Permission Types
An access rule grants one or more permissions on a folder. The web interface uses these names:
Show Contents
Lists the files and subfolders in the folder. Without this permission, an upload-only user can access the assigned folder but does not see its existing contents.
Download (Read)
Opens or downloads files. Selecting this permission also grants Show Contents.
Upload (Write)
Uploads files, creates folders, and overwrites files. This permission does not grant Show Contents by itself.
Delete
Deletes files or folders. Selecting this permission also grants Show Contents.
The four permissions are independent except for the Show Contents behavior described above. A user can therefore receive upload-only access without download or delete access.
How Permissions Combine
ExaVault permissions are additive grants. The effective permissions on a folder are the combination of every applicable rule:
permissions granted directly to the user;
permissions granted to any group the user belongs to; and
permissions inherited from rules on parent folders within the user's Home Directory.
A direct user rule does not replace a group rule, and one group does not replace another group. A rule on a child folder also cannot remove access inherited from a parent. If any applicable rule grants a permission, the user receives it.
For example, suppose the Vendors group has Show Contents and Download (Read) on /Projects, while one user has Upload (Write) on /Projects/Incoming. That user can list, download, and upload within /Projects/Incoming because the parent group grant and the direct child-folder grant combine.
Normal ExaVault folder permissions do not include a deny rule. To remove a permission, change or remove every direct, group, or parent-folder rule that grants it.
Permissions Required for Common Actions
Some operations need permissions on both the source and destination.
Browse a folder
Show Contents on the folder
Open or download a file
Download (Read) on the file's folder
Upload a file, create a folder, or overwrite a file
Upload (Write) on the destination folder
Copy an item
Download (Read) on the source and Upload (Write) on the destination
Move or rename an item
Download (Read) and Delete on the source, plus Upload (Write) on the destination
Delete an item
Delete on the folder containing the item
Because Download (Read) and Delete include Show Contents, you do not need to select Show Contents separately when either of those permissions is granted.
Assign Folder Permissions
Administrators can manage access from either the user or group record. Open Users, open the action menu for the user or group, and select Access. Select the folder, then enable the permissions to grant on that folder.
You can also select a folder in Files and use Access to add or remove users and groups for that folder.
The interface prevents a delegated manager from granting a permission the manager does not have. An access rule must target a folder rather than a file and must grant at least one permission.
Use groups for access shared by several accounts, then reserve direct user rules for real exceptions. This keeps reviews manageable and reduces the chance that an old one-off rule continues granting access after a user's responsibilities change.
Investigate Unexpected Access
When a user can do more than one visible rule appears to allow, review all sources of access. Check the user's direct rules, every group membership, and the rules on each parent folder. A narrower rule with fewer selected permissions does not cancel a broader grant.
When a user can upload but cannot see existing files, the account has Upload (Write) without Show Contents. This is the expected upload-only behavior.
For a failed move or rename, check both sides of the operation. The source requires Download (Read) and Delete, while the destination requires Upload (Write).
Last updated