# Storage (/docs/reference/roles-permissions/storage)



Storage permissions are baseline tenant-member capabilities. Files and folders still require resource-level access: viewers can read, editors can write, and owners can delete or share. Folder permissions can be inherited by child folders and files.

The `storage.space.*` family covers folder and supported collection operations; it does not grant direct S3 bucket administration. Collection APIs retain tenant/configuration boundaries and active-collection safeguards. A download permission is separate from metadata-read permission.

Sharing uses the [Authorization family](/docs/reference/roles-permissions/authorization). Tenant administration does not make every private file readable.

## Permissions [#permissions]

This family contains **11 permissions**. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### storage.object.create [#storageobjectcreate]

      <span className="catalogue-description">
        Upload a file into the tenant library.
      </span>
    </summary>

    <div className="catalogue-content">
      Upload a file into the tenant library. Uploading into a folder also requires write access to that folder.

      | Property     | Value                                                                                                                                                                  |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                        |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership)                                                                           |
      | Custom role  | Yes                                                                                                                                                                    |
      | Also implies | [storage.object.list](/docs/reference/roles-permissions/storage#storageobjectlist), [storage.object.read](/docs/reference/roles-permissions/storage#storageobjectread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.object.delete [#storageobjectdelete]

      <span className="catalogue-description">
        Delete a file with resource-level delete authority, including applicable inherited folder authority.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete a file with resource-level delete authority, including applicable inherited folder authority.

      | Property     | Value                                                                                                                                                                                                                                                          |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                                                |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership)                                                                                                                                                                   |
      | Custom role  | Yes                                                                                                                                                                                                                                                            |
      | Also implies | [storage.object.list](/docs/reference/roles-permissions/storage#storageobjectlist), [storage.object.read](/docs/reference/roles-permissions/storage#storageobjectread), [storage.object.update](/docs/reference/roles-permissions/storage#storageobjectupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.object.download [#storageobjectdownload]

      <span className="catalogue-description">
        Download an accessible file.
      </span>
    </summary>

    <div className="catalogue-content">
      Download an accessible file. This is separate from metadata-read permission.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.object.list [#storageobjectlist]

      <span className="catalogue-description">
        List files visible to the caller.
      </span>
    </summary>

    <div className="catalogue-content">
      List files visible to the caller.

      | Property     | Value                                                                                        |
      | ------------ | -------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                              |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role  | Yes                                                                                          |
      | Also implies | [storage.object.read](/docs/reference/roles-permissions/storage#storageobjectread)           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.object.read [#storageobjectread]

      <span className="catalogue-description">
        Read accessible file metadata or document content through supported library and collection operations.
      </span>
    </summary>

    <div className="catalogue-content">
      Read accessible file metadata or document content through supported library and collection operations.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.object.update [#storageobjectupdate]

      <span className="catalogue-description">
        Change an accessible file's metadata or folder location, with the required resource-level write access.
      </span>
    </summary>

    <div className="catalogue-content">
      Change an accessible file's metadata or folder location, with the required resource-level write access.

      | Property     | Value                                                                                                                                                                  |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                        |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership)                                                                           |
      | Custom role  | Yes                                                                                                                                                                    |
      | Also implies | [storage.object.list](/docs/reference/roles-permissions/storage#storageobjectlist), [storage.object.read](/docs/reference/roles-permissions/storage#storageobjectread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.space.create [#storagespacecreate]

      <span className="catalogue-description">
        Create a folder or invoke a supported collection-creation operation.
      </span>
    </summary>

    <div className="catalogue-content">
      Create a folder or invoke a supported collection-creation operation. Collection operations retain their configuration and scope checks.

      | Property     | Value                                                                                                                                                              |
      | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
      | Scope        | Selected tenant                                                                                                                                                    |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership)                                                                       |
      | Custom role  | Yes                                                                                                                                                                |
      | Also implies | [storage.space.list](/docs/reference/roles-permissions/storage#storagespacelist), [storage.space.read](/docs/reference/roles-permissions/storage#storagespaceread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.space.delete [#storagespacedelete]

      <span className="catalogue-description">
        Delete a folder or invoke a supported collection-deletion operation.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete a folder or invoke a supported collection-deletion operation. Resource and active-collection safeguards still apply.

      | Property     | Value                                                                                                                                                                                                                                                    |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                                          |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership)                                                                                                                                                             |
      | Custom role  | Yes                                                                                                                                                                                                                                                      |
      | Also implies | [storage.space.list](/docs/reference/roles-permissions/storage#storagespacelist), [storage.space.read](/docs/reference/roles-permissions/storage#storagespaceread), [storage.space.update](/docs/reference/roles-permissions/storage#storagespaceupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.space.list [#storagespacelist]

      <span className="catalogue-description">
        List accessible folders or tenant-scoped collections through their respective APIs.
      </span>
    </summary>

    <div className="catalogue-content">
      List accessible folders or tenant-scoped collections through their respective APIs.

      | Property     | Value                                                                                        |
      | ------------ | -------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                              |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role  | Yes                                                                                          |
      | Also implies | [storage.space.read](/docs/reference/roles-permissions/storage#storagespaceread)             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.space.read [#storagespaceread]

      <span className="catalogue-description">
        Inspect a tenant-scoped collection through supported collection operations.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect a tenant-scoped collection through supported collection operations.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### storage.space.update [#storagespaceupdate]

      <span className="catalogue-description">
        Update a folder with resource-level write access.
      </span>
    </summary>

    <div className="catalogue-content">
      Update a folder with resource-level write access.

      | Property     | Value                                                                                                                                                              |
      | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
      | Scope        | Selected tenant                                                                                                                                                    |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership)                                                                       |
      | Custom role  | Yes                                                                                                                                                                |
      | Also implies | [storage.space.list](/docs/reference/roles-permissions/storage#storagespacelist), [storage.space.read](/docs/reference/roles-permissions/storage#storagespaceread) |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)