Storage
File objects, folders and tenant-scoped collections.
Storage permissions are baseline tenant-member capabilities. Files and folders still require resource-level access: viewers can read, editors can write, and owners can delete or share. Folder permissions can be inherited by child folders and files.
The storage.space.* family covers folder and supported collection operations; it does not grant direct S3 bucket administration. Collection APIs retain tenant/configuration boundaries and active-collection safeguards. A download permission is separate from metadata-read permission.
Sharing uses the Authorization family. Tenant administration does not make every private file readable.
Permissions
This family contains 11 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.
storage.object.create
Upload a file into the tenant library.
Upload a file into the tenant library. Uploading into a folder also requires write access to that folder.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.object.list, storage.object.read |
storage.object.delete
Delete a file with resource-level delete authority, including applicable inherited folder authority.
Delete a file with resource-level delete authority, including applicable inherited folder authority.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.object.list, storage.object.read, storage.object.update |
storage.object.download
Download an accessible file.
Download an accessible file. This is separate from metadata-read permission.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
storage.object.list
List files visible to the caller.
List files visible to the caller.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.object.read |
storage.object.read
Read accessible file metadata or document content through supported library and collection operations.
Read accessible file metadata or document content through supported library and collection operations.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
storage.object.update
Change an accessible file's metadata or folder location, with the required resource-level write access.
Change an accessible file's metadata or folder location, with the required resource-level write access.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.object.list, storage.object.read |
storage.space.create
Create a folder or invoke a supported collection-creation operation.
Create a folder or invoke a supported collection-creation operation. Collection operations retain their configuration and scope checks.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.space.list, storage.space.read |
storage.space.delete
Delete a folder or invoke a supported collection-deletion operation.
Delete a folder or invoke a supported collection-deletion operation. Resource and active-collection safeguards still apply.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.space.list, storage.space.read, storage.space.update |
storage.space.list
List accessible folders or tenant-scoped collections through their respective APIs.
List accessible folders or tenant-scoped collections through their respective APIs.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.space.read |
storage.space.read
Inspect a tenant-scoped collection through supported collection operations.
Inspect a tenant-scoped collection through supported collection operations.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
storage.space.update
Update a folder with resource-level write access.
Update a folder with resource-level write access.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | storage.space.list, storage.space.read |