Overview
Grant or deny resource access through database-managed principals such as users, roles, teams, groups, and applications.
Problem
Workspace-level application permissions alone are too broad for sensitive files and folders.
Solution
Evaluate File-Vault resource ACLs after the workspace/app permission boundary.
How it works
Resource permissions can target supported principal types, allowing configured access decisions to be made for the specific file or folder being requested.
Who is this for
Document Administrator
Security Administrator
Expected outcomes
- Fine-grained resource control
- Role and application access driven by explicit database policy rather than magic role names
Key metrics
Security impact
- Resource ids, principal type/id, permission code, effect, and authorization context · PII: may include user or group identifiers
Compliance
- Workspace permission, resource ACL evaluation, owner authority from Core, and audit
Availability & next steps
Business
Enterprise