> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Assign a bucket

A new sub-user cannot reach any bucket. You give it access with an **access rule**: a bucket (or one folder in it) plus a permission level. You can add rules from the sub-user's page or from the **Policies** page — both create the same kind of rule, and every rule shows up in both places.

You can only assign buckets that are in one of the sub-user's [regions](/sub-users/regions).

## From the sub-user's page

#### Open the sub-user

In the sidebar, open **Subusers** and select the sub-user's name.

#### Pick a bucket

Under **Bucket Access Management**, select **Assign New Bucket** and choose a bucket from **Available Buckets**.

![The sub-user's page with the Assign New Bucket list open, showing available buckets and their regions](/_fern-img/76cdfa8279ecb94c995a10aa7399f3613dcfa9354a5e20d7cf961ba0e8c7201c.webp)

#### Add a rule

The bucket's rule page opens. Select **Add Access Rule**.

![A bucket's access rule page for a sub-user with no rules yet and the Add Access Rule button](/_fern-img/e1126d0b0a31d6159aab3317e396440656afa84a3aaa3db264cdf6d88491852d.webp)

#### Set the permission

In the **Add Access Rule** dialog:

* **Permission** — choose **View Only**, **Upload Only**, **View & Upload** or **Full Access**. See [Permission levels](/sub-users/access-types#permission-levels).
* **Scope** — leave it empty for the whole bucket, or enter a folder such as `photos/2026` to limit the rule to that folder. If the folder does not exist yet, Zata offers to create it.
* **Notes** — an optional name for the rule.

Select **Create Rule**.

![The Add Access Rule dialog with the Permission list open showing View Only, Upload Only, View & Upload and Full Access](/_fern-img/85a4a31a8bf3ec82332c4b6b35e85f5583e7da76f416db48652a767147c140cc.webp)

The rule appears on the page with the status **Active**, and the bucket now counts as assigned on the sub-user's page. Add more rules to the same bucket if you need different permissions for different folders.

![The Manage Bucket Access Rules page with one Active rule for the entire bucket and edit, suspend and delete icons](/_fern-img/b74023e727b323af3b5425f7cf607bace1b017b1ddf75ec468e247092abc68c1.webp)

## From the Policies page

Use the **Policies** page when you want to pick single actions instead of a permission level. Select **Create Policy**, choose **Subuser** as the grantee and select the sub-user, then follow the wizard. See [Create a policy](/access/bucket-policies#create-a-policy).

![The Grantee step of Create access policy with Subuser selected and a sub-user chosen](/_fern-img/2e2e78007b440e25977cfad4aecbeb20714e3e988bcf407e5822a049f6e9d48a.webp)

Only active sub-users can be picked here. For a sub-user whose invitation is still pending, use the sub-user's page.

## Change or remove access

On the sub-user's page, select the bucket to open its rules. Each rule has four buttons:

| Button           | What it does                                    |
| ---------------- | ----------------------------------------------- |
| **Edit rule**    | Change the permission, scope or notes.          |
| **Suspend rule** | Block this access for now. Nothing is deleted.  |
| **Resume rule**  | Turn a suspended rule back on.                  |
| **Delete rule**  | Remove the access for good (**Revoke Access**). |

You can also edit, suspend or delete the same rules from their cards on the **Policies** page.