> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/administration/permissions/access-controls.md).

# Access Controls

Learn about Access Controls in Couchdrop

## Overview

Couchdrop provides multiple layers of access control to determine what users can access, which services they can use, and what actions they can perform.

Access is managed through a combination of role-based controls and more granular user, resource, and connection restrictions.

## Role-Based Access Controls (RBAC)

Role-Based Access Control is used to manage access based on a user's assigned role or group membership.

In Couchdrop, this includes:

### User Roles

User Roles define a user's broader level of administrative or operational access.

Roles separate users who manage the Couchdrop account from users who only require operational or external access.

For more information, see [**User Roles**](/administration/user-and-group-management/user-roles.md).

### Groups

Groups let you apply common access settings to multiple users.

They can be used to assign shared roles, feature access, and other access settings consistently across a set of users.

For more information, see [**Groups**](/administration/user-and-group-management/groups.md).

### Feature Access

Feature Access determines which Couchdrop services and features a user or group can use.

This includes controls for:

* SFTP and SCP
* FTP and FTPs
* Upload Portal
* Web Portal
* Shared Links
* Inboxes
* Transfer Automations and Actions
* Inbound AS2 Stations

Feature Access can be configured separately from a user's broader role.

For more information, see [**Feature Access**](/administration/permissions/features-access.md).

## Attribute and Resource-Based Access Controls

Couchdrop also provides more granular controls based on the user, the resource being accessed, and the connection context.

These controls can be used alongside roles and groups to further restrict access.

### Root Directory

A user's Root Directory defines the highest level of the filesystem they can access.

Users cannot navigate above their assigned Root Directory and only see paths relative to that location.

For more information, see [**Root Directory**](/administration/user-and-group-management/root-directory.md).

### Folder Permissions

Folder Permissions control what specific users and groups can do within individual folders.

Available permissions include:

* **List Contents**
* **Get Properties**
* **Delete**
* **Upload**
* **Download**
* **Share**
* **Create Inbox**
* **Manage Permissions**
* **Manage Notifications**

Folder Permissions use inheritance, allowing access to be applied broadly and overridden on specific folders where required.

For more information, see [**Folder Permissions**](/administration/permissions/folder-permissions.md).

### Network ACLs

Network ACLs can restrict a user so they can only connect from approved IP addresses or networks.

This provides an additional connection-level restriction alongside user permissions.

For more information, see [**Firewalls and ACLs**](/security-and-governance/firewalls-and-acls.md).

### Expiry

User expiry controls how long a user account remains active.

A user can be configured to never expire or to expire after a specified period.

For more information, see [**Account Expiry**](/security-and-governance/user-and-account-policies/account-expiry.md).

## How Access Controls work together

These controls can be combined to create a more specific access model.

For example, an external partner could be configured with:

* An **External User** role
* Membership in a partner **Group**
* **SFTP and SCP Connections** enabled
* `/Customers/Partner-A` as their **Root Directory**
* **List Contents** and **Upload** permissions on selected folders
* A **Network ACL** restricting connections to an approved network
* An **Expiry** date for temporary access

Each control addresses a different part of access:

<table data-search="false"><thead><tr><th width="191.45703125">Control</th><th>Purpose</th></tr></thead><tbody><tr><td><strong>User Roles</strong></td><td>Defines broad administrative or operational access</td></tr><tr><td><strong>Groups</strong></td><td>Applies common access settings to multiple users</td></tr><tr><td><strong>Feature Access</strong></td><td>Controls which Couchdrop services can be used</td></tr><tr><td><strong>Root Directory</strong></td><td>Restricts filesystem visibility</td></tr><tr><td><strong>Folder Permissions</strong></td><td>Controls actions on specific folders</td></tr><tr><td><strong>Network ACLs</strong></td><td>Restricts where a user can connect from</td></tr><tr><td><strong>Expiry</strong></td><td>Restricts how long access remains available</td></tr></tbody></table>

Together, these controls let you manage both broad access and more granular restrictions without relying on a single permission model.