> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Policies

The four [permission levels](/sub-users/access-types#permission-levels) cover most needs. When you need something in between — for example **Download files** without **List files**, or a **Deny** rule that blocks deletes in one folder — create a policy for the sub-user on the **Policies** page.

## Create a policy for a sub-user

On the **Policies** page, select **Create Policy** and choose **Subuser** as the grantee. Then pick the bucket, the scope and the exact actions. The full walkthrough is in [Bucket policies](/access/bucket-policies#create-a-policy).

* You can give a sub-user any action on the Policies page except **Change file permissions**, **Add/edit file tags**, **Change versioning** and **Manage bucket tags**. These are not shown for sub-users.
* Choose **Deny** as the effect to block actions that another rule allows.
* The policy also appears on the sub-user's page, next to the rules you added there.

## Requests from sub-users

A sub-user with dashboard access can ask for more actions on a bucket it already has a policy for. It does this from the **Bucket Policies** page of its dashboard by selecting **Request Policy** (see [what the sub-user sees](/sub-users/portal/policies)). It cannot request Object Lock actions.

When a request arrives, you get a notification and an email.

### Approve or reject a request

#### Open the requests

On the **Policies** page, select **Policy Requests**. The **Pending Policy Requests** page lists the requests by sub-user, with the bucket and the date of each request.

#### Decide

For each requested action, select **Approve** or **Reject**. To handle several at once, tick them and select **Approve selected** or **Reject selected**. When a sub-user asked for several actions together, **Approve selected, reject rest** lets you approve some and reject the others in one go.

#### Add a remark (optional)

When you reject, you can add a remark explaining why. The sub-user sees it. Select **Confirm Reject**.

Approved actions are added to the sub-user's existing policy for that bucket straight away. The sub-user gets a notification and an email with the result, and can see rejected requests and your remarks in its **Rejected** tab.