Waterfall Permission Model

FileAgo implements a very flexible permission model, with the core concept that permissions applied to a folder applies to all the child resources inside it unless overridden.

This should be clear to the reader once we discuss the below example in detail:

Sharing User owned data

 

Folder	Sally	Claire	Michael	John
My Documents	no access	no access	read	read, write, delete
Sales Stuff	read	read, write	read, write, delete	read, write, delete
Client Details	read	read	read, write, delete	read, write, delete
Acme Inc	read, write	read	read, write, delete	read, write, delete

As shown in the graphic above, Sales group consists of 4 members - John, Sally, Claire and Michael. The permissions of those users for each folders is listed in the table.

John has full access (read, write and delete) on all the folders. It is obvious given that John is the owner of those folders.

The folder My Documents is shared with Michael with read permission. Claire and Sally will not be able to access My Documents folder.

Things start to get interesting from here on.

John has shared Sales Stuff folder with Sales group with read, write and delete permissions. However, Sally is a member of Sales group with read permissions only. Therefore, Sally has only read permissions in this folder.

Likewise, Claire has read and write permissions in the group, and these are the permissions Claire will receive in the Sales Stuff folder. In the case of Michael - he has full permissions in the group, and therefore has full permissions in this folder as well.

Coming to Client Details folder, the read permission for Sally from its parent folder applies to this one as well. John has overridden Claire’s permissions in this folder and set it to read permissions, so that is ther permission available for Claire. Michael’s permissions on the parent folder will apply here.

And finally, John has overriden permissions for Sally in Acme Inc folder and granted her read and write access, so those are the permissions that will be available for her.

Permissions for Claire and Michael in Acme Inc will be the same as its parent folder.

Sharing Group owned data

When it comes to sharing files owned by a Group, there is a configuration setting which determines how the permissions will work. An admin user can access it under Security section of the Settings page in the Admin Panel:

When enabled

If a user is part of multiple groups (let’s say Group A and Group B), and if a resource of Group A is shared with Group B, then the user’s permissions on that shared resource will be that of its permissions assigned by Admin / Group Admin in Group A.

When disabled

If a user is part of multiple groups (let’s say Group A and Group B), and if a resource of Group A is shared with Group B, then the user’s permissions on that shared resource will be that of its permissions assigned by Admin / Group Admin in Group B.

We will discuss both cases with the following example:

Although the folder names and structure is same as in the first example, in this case they are owned by the Sales Group, and not by a user. We also have another group called Marketing Group with the same set of users, but with different permissions.

By default, users Sally, Claire and Michael will have access in the Home folder of the Sales group since they are members of the group. However, their permissions will vary according to the permissions that were granted to their user accounts by an Admin or Group Admin.

Only group permissions matter for group members = enabled

Folder	Sally	Claire	Michael	John
My Documents	read	read, write	read	no access
Sales Stuff	read	read, write	read	read, write
Client Details	read	read	read	read, write
Acme Inc	read, write	read	read	read, write

In the case of My Documents folder, the group permissions applies for users Sally (read) and Claire (read, write). Group permissions for Michael is overridden and he only has read permissions in this folder. Since John is not a member of the Sales group, he has no access.

For Sales Stuff folder, we see that Marketing Group has been allowed full access to it. However, since only the current group permissions matter for group members, Sally, Claire and Michael will still be granted access as per its parent folder.

In the case of John, he is not a member of Sales group, so his permissions will be based on the permissions that were assigned to him in Marketing Group (which is read, write).

Claire has read permissions in Client Details folder, which will be applied for her while the rest of the users will have the same permissions as in the parent folder.

Similarly, Sally has being set to have read, write permissions in Acme Inc, and the rest of the users will continue to have the same permissions as in the folder above it.

Only group permissions matter for group members = disabled

Folder	Sally	Claire	Michael	John
My Documents	read	read, write	read	no access
Sales Stuff	read, write, delete	read, write, delete	read, write	read, write
Client Details	read, write, delete	read	read, write	read, write
Acme Inc	read, write	read	read, write	read, write

Starting with My Documents folder, the group permissions applies for users Sally (read) and Claire (read, write). Group permissions for Michael is overridden and he only has read permissions in this folder. Since John is not a member of the Sales group, he has no access.

For Sales Stuff folder, we see that Marketing Group has been allowed full access to it, and that determines the permissions for Sally, Claire and Michael as well along with John who is a member of Marketing Group.

Sally and Claire has full permissions in Marketing Group, so they receive full access in Sales Stuff folder as well. Permissions of Michael and John are read, write in Marketing group, so that is the permissions they will have in this folder.

Claire has been assigned read permissions in Client Details folder, so that is the permission she will have to be content with. Sally, Michael and John will have the same permissions that they had in the folder just above this one.

In Acme Inc folder, Sally has been assigned read, write permissions, and that is the permission she will be having. Claire, Michael and John will be the same permissions that they had in the parent folder (Client Details).

In Workspace

The permissions applied to a folder or file is listed under Permissions section in the right sidebar.

For example, Permissions section for John’s Acme Inc folder from the first example will look something like this:

Acme Inc folder from the Group example will look like:

With ‘Only group permissions matter for group members’ enabled :

With ‘Only group permissions matter for group members’ disabled :