By default the whole workspace sees every folder. With access lists you restrict individual folders to specific people and roles, with clear levels and inheritance to subfolders.
Rights and places: how they interact
Two layers together decide who may do what:
- Role permissions say what someone may do in general (upload, delete, share). The matrix is on the overview.
- Folder access lists say where that applies.
Both must hold: someone without the write permission for files stays read-only even with the edit level on a folder. And the strongest write permission is useless in a folder the access list does not open.
Managing access
On normal folders (not on the system roots such as Tools or Properties) you open Manage access... (Zugriff verwalten...) in the context menu. The dialog explains the principle like this (German original):
Ohne Einträge ist der Ordner für den ganzen Workspace sichtbar. Sobald du jemanden hinzufügst, sehen ihn nur noch die gelisteten Personen und Rollen (plus Inhaber:in). Unterordner erben die Einschränkung.
In short: without entries, the folder is visible to the whole workspace. As soon as you add someone, only the listed people and roles (plus the owner) can see it, and subfolders inherit the restriction. Restricting is reserved for owners and admins (the "restrict folder access" permission).
The three levels
More rules:
- A person entry beats a role entry: if a person is listed directly, their entry wins even when their role has a different one.
- The last manage entry stays: the dialog prevents everyone locking themselves out: "Der letzte Eintrag mit Verwalten-Stufe kann nicht entfernt werden." (The last entry with the manage level cannot be removed.)
Visibility of restricted folders
- Restricted folders carry a lock icon in grid, list and details panel.
- Whoever is not authorised does not see the folder at all: not in the file area, not in search, not in file pickers.
- Under Settings > Files, owners and admins see the restricted folders overview with all authorised people and levels.
Special case: My files
The My files (Meine Dateien) area needs no access list: it is private by design. Only the person themselves sees the contents, not even admins and owners. Settings show only the total size per person (file count and storage), never the content.
Offboarding: orphaned areas
When someone leaves the workspace, their private area remains and is marked as "former member · orphaned" in the members' My files list under Settings > Files. Only the owner can then decide:
- Take over: the area becomes a normal workspace folder, the content stays.
- Delete: the area moves to the trash and follows the normal retention there.
Further reading
For sharing with externals (without workspace access) there are share links: Sharing externally. Back to the overview.