> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Access types and permissions

Two separate choices decide what a sub-user can do:

* The **access type** decides **how** it connects — with keys only, or with keys and a dashboard login. You choose it when you [create the sub-user](/sub-users/create-a-sub-user).
* The **permissions** decide **what** it can do in each bucket. You set them when you [assign a bucket](/sub-users/assign-a-bucket). The access type alone gives no access to any bucket.

## Access types

| Access type                         | How it connects                                                                    | Email and invitation                                                                                 |
| ----------------------------------- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| **Programmatic access only**        | Access keys in S3 tools, SDKs and scripts. No dashboard login.                     | Not needed. The keys work at once.                                                                   |
| **Programmatic + Dashboard access** | Access keys, plus a login to the [sub-user dashboard](/sub-users/portal/overview). | Needed. The keys and login work after the sub-user [accepts the invitation](/sub-users/invitations). |

To give a programmatic sub-user dashboard access later, use **Upgrade to Console** on its page. See [Give dashboard access later](/sub-users/invitations#give-dashboard-access-later).

## Permission levels

When you assign a bucket from the sub-user's page, you pick one of four levels:

| Permission        | Console hint             | The sub-user can                                                                                                                            | S3 actions                                                                                                                   |
| ----------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **View Only**     | Read and list            | List files and download them, including old versions                                                                                        | `ListBucket`, `GetObject`, `GetObjectVersion`                                                                                |
| **Upload Only**   | Create folder and upload | Upload files and create folders. Cannot list or download.                                                                                   | `PutObject`, `AbortMultipartUpload`                                                                                          |
| **View & Upload** | Read and write           | Everything in View Only, plus upload, list versions and view file tags. Cannot delete.                                                      | adds `PutObject`, `AbortMultipartUpload`, `ListBucketVersions`, `GetObjectTagging`                                           |
| **Full Access**   | Complete control         | Everything in View & Upload, plus delete files and versions, remove file tags, and view file permissions, versioning status and bucket tags | adds `DeleteObject`, `DeleteObjectVersion`, `DeleteObjectTagging`, `GetObjectAcl`, `GetBucketVersioning`, `GetBucketTagging` |

* A level can apply to the whole bucket or to one folder. For a folder, **Full Access** does not include the bucket-wide **View versioning status** and **View bucket tags**.
* Uploading a file with the same name as an existing file replaces it. **Upload Only** and **View & Upload** can therefore overwrite files. Turn on [versioning](/buckets/bucket-settings) if you need to keep old copies.
* Some actions can never be given to a sub-user, whatever the level. See [What a sub-user can and cannot do](/sub-users/overview#what-a-sub-user-can-and-cannot-do).
* In lists, a rule shows its **Notes** text if you entered one, otherwise the name of its permission set. A **View Only** rule appears as **View & Download**.

## Pick single actions

If none of the four levels fits, create a policy on the **Policies** page and tick the exact actions you want, for example **Download files** only. See [Sub-user policies and requests](/sub-users/policies).