Skip to navigation
Sub-users

Policies

Give a sub-user single actions, and approve its requests for more access.

The four permission levels cover most needs. When you need something in between — for example Download files without List files, or a Deny rule that blocks deletes in one folder — create a policy for the sub-user on the Policies page.

Create a policy for a sub-user

On the Policies page, select Create Policy and choose Subuser as the grantee. Then pick the bucket, the scope and the exact actions. The full walkthrough is in Bucket policies.

  • You can give a sub-user any action on the Policies page except Change file permissions, Add/edit file tags, Change versioning and Manage bucket tags. These are not shown for sub-users.
  • Choose Deny as the effect to block actions that another rule allows.
  • The policy also appears on the sub-user’s page, next to the rules you added there.

Requests from sub-users

A sub-user with dashboard access can ask for more actions on a bucket it already has a policy for. It does this from the Bucket Policies page of its dashboard by selecting Request Policy (see what the sub-user sees). It cannot request Object Lock actions.

When a request arrives, you get a notification and an email.

Approve or reject a request

1

Open the requests

On the Policies page, select Policy Requests. The Pending Policy Requests page lists the requests by sub-user, with the bucket and the date of each request.

2

Decide

For each requested action, select Approve or Reject. To handle several at once, tick them and select Approve selected or Reject selected. When a sub-user asked for several actions together, Approve selected, reject rest lets you approve some and reject the others in one go.

3

Add a remark (optional)

When you reject, you can add a remark explaining why. The sub-user sees it. Select Confirm Reject.

Approved actions are added to the sub-user’s existing policy for that bucket straight away. The sub-user gets a notification and an email with the result, and can see rejected requests and your remarks in its Rejected tab.