Introduction

This article explains how LucidLink determines the access a member has to any folder or file in a filespace. If you're looking for steps to grant, change, or remove permissions, see Administer Filespace Permissions.

When you give a member or a group access to a folder, that access doesn't stop at the folder itself. It automatically carries down to every file and subfolder inside it. This is called permission inheritance. Knowing how it works helps you set up permissions that are easy to maintain and give everyone exactly the access they need.

Note: Workspace owners, administrators, and filespace administrators always have full Read and Write access to the entire filespace. The rules below apply to all other roles.

Key concepts

Before we look at examples, here are a few terms used throughout this article:

• Access type: either Read (browse and open files) or Write (browse and open files, as well as create, change and delete them).
• Granted permission: access that an administrator gives on a specific folder (or the whole filespace), either directly to a member or to a group.
• Inherited permission: implicit access derived from the permissions of a parent directory.

Note: Permissions are granted on folders or on the whole filespace. Files always get their access from the folder they're in.

Members, groups, and service accounts follow the same rules

A member or a service account can get access to a folder in two ways:

• Directly, when an administrator grants access to the member/service account themselves.
• Through a group, when an administrator grants access to a group the member/service account belongs to.

Inheritance works in exactly the same way for both. Whenever this article mentions a member or group, the rule applies equally to permissions granted directly to a member and to permissions granted to a group.

How inheritance works

LucidLink uses two simple rules to work out a member's access to any folder or file.

Rule 1: The closest permission wins

For a single member or group, access to a folder is determined as follows:

1. If the member or group has a permission granted directly on that folder, that permission applies.
2. If not, LucidLink looks at the folder above it, then the one above that, and so on up to the root of the filespace. The first permission it finds for that same member or group applies.

This means a permission granted on a subfolder replaces the inherited one for that member or group, whether it gives more access or less. For example, you can give a member Write access to a whole project, but only Read access to one subfolder that shouldn't be changed. You can read more about this in the Examples section below.

Rule 2: Access from different sources adds up

A member often gets access from several sources at once: their direct permissions, and each group they belong to. LucidLink works out the access from each source separately using Rule 1, and then combines them. The member gets the highest access from any of them.

For example, if you've been given Read access to a folder directly, but one of your groups has Write access to it, you have Write access to that folder. The same is true the other way around, and between two groups.

Note: Permissions in LucidLink can only grant access, never deny it. Granting a member a new permission or adding them to another group can only give them more access, never less. To restrict someone's access to a folder, review both their direct permissions and the permissions of every group they belong to.

Examples

Let's look at a video production team using a filespace with the following folders:

In each example, Sam is a member of the workspace, and we'll work out what access Sam has to each folder. The Granted to column shows whether a permission was granted to Sam directly or to a group Sam belongs to.

Example 1: Access carries down to everything inside a folder

Result: Sam has Write access to "Projects" and everything inside it: "Budget.xlsx", "Summer Campaign", "Raw Footage" and "Final Cut". Sam has no access to "Templates", because no permission was granted on it or on a folder above it.

The result would be exactly the same if Write access on "Projects" was granted to a group Sam belongs to instead.

Example 2: Protecting a subfolder from changes

The final cut has been approved, and you want the editors to stop changing it while still being able to watch it. Sam is in the Editors group.

Result: Sam still has Write access to "Projects", "Budget.xlsx", "Summer Campaign" and "Raw Footage", but only Read access to "Final Cut". For the Editors group, the permission on "Final Cut" is the closest one, so it replaces the Write access inherited from "Projects".

Example 3: Letting a member upload to just one subfolder

Sam is a freelance camera operator who should be able to browse the project and upload footage, but not change anything else. Sam isn't in any group, so you grant access to Sam directly.

Result: Sam has Read access to “Projects”, “Budget.xlsx”, “Summer Campaign” and “Final Cut”, and Write access to “Raw Footage”. Just like for a group, Sam's permission on “Raw Footage” is the closest one, so it replaces the Read access inherited from “Projects”.

Example 4: A direct permission gives more access than a group

Everyone in the company has Read access to projects, and Sam, who leads the summer campaign, also needs Write access to the campaign. Sam is in the All Staff group.

Result:

• Sam has Read access to "Projects" and "Budget.xlsx" through All Staff.
• Sam has Write access to "Summer Campaign", "Raw Footage" and "Final Cut". All Staff gives Read access and Sam's direct permission gives Write access, so Sam gets the higher of the two.

The result would be the same if the Write access on "Summer Campaign" was granted to another group Sam belongs to, such as a Summer Campaign Team group.

Example 5: A permission from another source can't take access away

Sam is in the Reviewers group.

Result: Sam has Write access to "Final Cut". The Reviewers group inherits Write access from "Projects", and Read access granted to Sam directly doesn't reduce it, because it comes from a different source.

Compare this with Example 2: to limit Sam to Read access on "Final Cut", the Read permission on "Final Cut" must be granted to the Reviewers group itself, which is where Sam's Write access comes from. The same applies between two groups: Read access granted to one group never reduces Write access that comes from another.

Example 6: Putting it all together

Sam is in the All Staff group and also has some permissions granted directly.

Result:

• "Templates": Write. All Staff inherits Write access from the whole filespace.
• "Projects", "Budget.xlsx", "Budget.xlsx" and "Raw Footage": Write. All Staff has Read access, because the permission on "Projects" is closer than the one on the whole filespace. Sam's direct permission gives Write access. Sam gets the higher of the two.
• "Final Cut": Read. All Staff inherits Read access from "Projects", not Write access from the whole filespace, because "Projects" is closer. Sam's direct permission on "Final Cut" is Read, which replaces the Write access Sam directly has on "Projects". Neither source gives Write access, so Sam only has Read access.

Note: All Staff's Write access on the whole filespace doesn't reach "Final Cut". Once a member or group has a permission on a folder, it applies to everything inside that folder until another permission for the same member or group is found further down.

Tips for managing permissions

• Start broad, then refine. Grant access on top-level folders and add permissions on subfolders only where you need an exception.
• Prefer groups for teams, and direct permissions for exceptions. Group permissions are easier to review and update as your team changes. Direct permissions work well for individual cases, such as a freelancer or a project lead who needs extra access.
• To limit access to a subfolder, change the permission where the access comes from. As Example 5 shows, granting lower access to a different member or group has no effect.
• Check all of a member's access. Because access from different sources adds up, a member's actual access depends on their direct permissions and every group they belong to. Review both to get the full picture.