Published: October 8, 2025
Last updated: March 10, 2026
Suggest an edit

Control user access to specific directories with allow/deny rules.

How Access Control Works

Rule Variables

  1. User scope — The user must have the source in their scopes.
  2. Deny/Allow — The default behavior is to allow user access, unless the source is configured with denyByDefault.
  3. Access rules — Allow/deny rules for specific directories.

Rule evaluation

When a user accesses a file or directory:

  1. Direct path check — Rules on the exact path are considered first.
  2. Recursive parent check — Parent directories are checked up to the root.
  3. Default behavior — Access is granted if no rule applies, unless denyByDefault is enabled.

Rule precedence

More specific paths override broader ones.

  • A rule on /folder/subfolder overrides a rule on /folder.
  • Allow rules take priority over deny rules when both apply.

Creating access rules

In the Web UI

  1. Open User Management or Group Management.
  2. Edit a user or group.
  3. Select a source.
  4. Open Access Rules.
  5. Add allow or deny rules for the directories you need.

Source configuration

denyByDefault

Configure per source in your config:

YAML 
1
2
3
4
5

server:
  sources:
    - path: "/data"
      config:
        denyByDefault: true  # Deny all unless explicitly allowed

With denyByDefault: true:

  • Users can see that the source exists.
  • There is no file access without explicit allow rules.
  • You must add allow rules for each path they should use.

Examples

Basic deny

Rule: Deny user graham access to /.

Result: graham cannot access any files or directories under that scope.

Allow a subfolder only

Rules:

  • Deny user graham access to /.
  • Allow user graham access to /subpath.

Result: graham can only access /subpath and its subdirectories.

Deny all with exceptions

Rules:

  • DenyAll on /vip.
  • Allow user admin access to /vip.

Result: Only admin can access /vip.

Departmental layout

Rules:

  • Allow group sales access to /departments/sales.
  • Allow group engineering access to /departments/engineering.
  • Deny all users access to /departments.

Result: Each department only reaches its own folder.

Rule types

Allow rules

Grant access to a path (read, write, execute, delete).

Deny rules

Explicitly deny access to a path.

DenyAll rules

Deny everyone for that path until a specific allow overrides it.

Troubleshooting

For common issues and fixes, see the Troubleshooting guide.