Permissions Management

Updated on 2025-03-07 GMT+08:00

View PDF

If you need to set different access permissions for employees in an enterprise to isolate permissions of different employees, you can set different authorization policies when creating or managing departments or team cloud space in KooDrive. KooDrive provides identity authentication, permissions management, and access control, helping you efficiently manage access to your cloud resources.

With the business control service, you can create KooDrive accounts for employees and authorize employees to control their access to resources.

If you want an employee to have all permissions on the department space, such as uploading files to, downloading files from, and deleting files from a team space, you can set the role of the employee to the department administrator or grant the permission to Manage.
If your employee is a common user of a department and you want the employee to only view the file directories in the department space, you can set the role of the employee to common user and grant the permission to View only.

KooDrive Permissions

An enterprise tenant who enables KooDrive on the Huawei Cloud console uses a Huawei Cloud account. After the KooDrive service is enabled, KooDrive creates a system administrator account using the Huawei Cloud account. After the account is used to sign in to the KooDrive service application, organizations (departments and users) and space management can be performed. Roles and permissions need to be granted to users created by the system administrator. The process in which user permissions can be allocated and managed in detail is called authorization. After authorization, the user can perform operations on KooDrive resources based on the granted permissions. System administrators can manage member permissions. Members having manage permissions can manage permissions of other members excluding administrators and themselves.

KooDrive uses the role-based access control policy for permission management. Permissions are associated with roles. Users can obtain the permissions assigned to a role by becoming members of the role. Table 1 describes permissions granted to each role, and Table 2 describes permissions that can be allocated to common users. Members having manage permissions are granted by the system, department administrator, or group administrator. These users serve as administrators for department and group spaces, and manage resources and members for these spaces.

**Table 1** KooDrive system-defined roles
Role Name	Description	Role Type
System administrator	The system administrator can perform operations on all KooDrive resources except the files in the individual spaces of other users.	System-defined role
Department administrator	Department administrator. Users with this permission can perform operations in their own departments, such as managing department spaces and personal spaces of department members. Administrators can manage department members' personal spaces, such as adjusting space size or deleting personal spaces. However, they cannot view the files in these spaces; these files are only accessible to their owners.	System-defined role
Group administrator	A user who creates a group is set as the group administrator and displayed as Owner. A group administrator manages resources and members of the own group.	System-defined role
Common user	A common user, the permissions are granted by administrators or members having manage permissions. For details about the permissions that can be granted, see Table 2.	System-defined role

**Table 2** Permission description
Permission Name	File List	Preview	Upload	Download	Share	Move	Copy	Rename	Delete	Create Folder	Manage Recycle Bin	Manage Members
Manage	√	√	√	√	√	√	√	√	√	√	√	√
All permissions	√	√	√	√	√	√	√	√	√	√
Unable to share	√	√	√	√		√	√	√	√	√
Unable to delete	√	√	√	√	√	√	√	√		√
Upload/Download/Share	√	√	√	√	√					√
Upload/Download	√	√	√	√						√
Upload	√	√	√	√						√
Download	√	√		√
Preview	√	√		√
View only	√

Department space permissions

System and department administrators are responsible for managing member permissions, excluding administrators. Members having manage permissions can mange permissions of other members, excluding administrators and themselves.
A system administrator can view space contents of all departments. Department administrators and members having manage permissions can only view file contents of their own departments. These three roles can set permissions for files and folders and perform operations on them.
In any department, both the system administrator and department administrator have administrator permissions and can modify non-administrators' permissions. However, administrators cannot modify their permissions of each other. To change department administrators, you must adjust their roles on the console. Members having manage permissions cannot modify each other's permissions.

Group space permissions

System administrators are responsible for managing member permissions; group administrators and members having manage permissions can manage member permissions. Members having manage permissions can manage permissions for members excluding themselves and owners. Group administrators can modify any member's permissions.
System administrators cannot view contents of all group spaces; only group space members can see the contents of their group spaces. Group administrators and members having manage permissions can manage permissions of files/folders in the group space and perform operations on them.

Previous topic: Before You Start

Next topic: Enabling KooDrive