---
id: "en/permissions"
title: "Permission system"
language: "en"
description: "The system introduces department roles, project permissions, file access control, sharing permissions, customized file permissions and online editing permissions."
canonical_url: "https://www.babel.cc/public/babelwiki/en/permissions.html"
markdown_url: "https://www.babel.cc/public/babelwiki/ai/en/permissions.md"
alternates: {"en": "https://www.babel.cc/public/babelwiki/ai/en/permissions.md", "zh": "https://www.babel.cc/public/babelwiki/ai/zh/permissions.md"}
reading_note: "文档记录不等于当前部署能力；以实际版本、授权模块与配置为准。保留原文的可选、限制及待确认说明，勿补猜接口。 / Documentation is not a guarantee for every deployment. Preserve optional-module requirements, limitations and unresolved API contracts."
---

# Permission system

Babel's permission system covers file list, search, preview, editing, synchronization, disk mapping, sharing, AI answering and automated tasks. Permissions are not a single switch, but are determined by corporate roles, department roles, project member permissions, file access control, custom file permissions, sharing permissions and corporate security policies.

![File access control](https://www.babel.cc/public/babelwiki/assets/images/file-access-control.jpg)
*File access control can set finer-grained access permissions for members or roles on specific files or folders.*

## Permission Judgment Level

| Hierarchy | Control Object | Example |
| --- | --- | --- |
| Enterprise roles | Enterprise-level management behaviors | Super administrator, security officer, security auditor, file administrator |
| Department roles | Department folders and department members | View, upload, download, edit, delete, department file management, sub-department management |
| Project permissions | Project folder | Project leader, project assistant, project members, member validity period |
| File access control | Single file or folder | Set invisible, viewable, editable, and validity period permissions for a member or role |
| Customize file permissions | Share, project, access control | Permission names and combinations defined by administrator |
| Sharing permissions | External or internal recipients | View, download, edit, comment, validity period, password, anonymous access |
| Security policy | Enterprise or department | IP policy, Mac binding, watermark, secret level, external sharing policy |

## File owner mode: enabled and disabled {#file-owner-mode}

**File Owner Mode (文件负责人模式) is a switch at the top of Enterprise Console → Permission Management (权限管理). Its owner-specific rules apply only when the switch is enabled.** When investigating access, first check the switch, the file's current owner and the member's department role.

![File Owner Mode switch and its explanation in Permission Management](https://www.babel.cc/public/babelwiki/assets/images/file-owner-mode.png)
*The switch is disabled in this Chinese interface screenshot. It shows the location and explanatory note, not a default setting for every enterprise. The enabled behavior is described below.*

| Switch state | Files you own | Files you do not own |
| --- | --- | --- |
| Enabled | You automatically have permission to manage the file, without restrictions from your department role | Your department role still applies; being a non-owner does not automatically prevent editing |
| Disabled | Owners are subject to department-role restrictions, just like other members | Your department role applies |

According to the interface note, you become the owner by default when uploading files or folders to a department. However, uploading into a folder owned by someone else does not automatically make you the file owner. **The uploader and the current file owner are not necessarily the same person.** The file owner and department management members can transfer ownership.

For example, when this mode is enabled, your department role does not restrict management of files you own. For a colleague's file, check whether your department role allows editing other people's files. For a specific editing failure, also check file access controls and the lock state. See the [department file editing FAQ](https://www.babel.cc/public/babelwiki/en/faq-sync.html#62-why-can-i-edit-some-files-in-the-department-but-not-others).

## Permission Components

Permission management of BabelBird Enterprise Drive is one of its core functions. It runs through the entire system to ensure that users can access and manage files safely and compliantly. The Babel permission system includes two main aspects: role permissions and file permissions.

### Role permissions

![Role permission configuration](https://www.babel.cc/public/babelwiki/assets/images/role-permissions.jpg)
*Administrators can combine department file, member management, sharing, download, editing, deletion, approval and other permissions in role settings.*

- Define roles: Babel allows you to define different roles within the enterprise. Each role can include a specific set of permissions to control users' access and operations in department folders. These roles can be created based on department management needs, such as "Department Administrator", "Department Member", etc.

- Department role permissions: Each department member can be assigned different access permissions based on their roles in different departments. This means that users can have different levels of permissions in different departments.

- Flexible management: Babel's role permissions support multiple department roles, and the same role can be used in different departments at the same time. After the permission content of a role is changed, the permissions of members using the same role will also be changed accordingly.

- Permission combination: Babel bird role permissions support the combination of more than 30 optional permissions to achieve refined user permission control. These permissions cover various access and operation behaviors, such as preview, upload, download, edit, etc.

- See Selectable permissions shown in the interface below for grouped option descriptions. Department roles and custom file permission combinations are configured under Permission Management → Department Permission List / File Permission List. Check permission names together with their actual selected options.

### File permissions

![File access control menu](https://www.babel.cc/public/babelwiki/assets/images/file-access-control-menu.jpg)
*The file access control menu adds finer-grained rules to a single file or folder.*

- Custom permissions: File permissions can also be customized in the background, and users can choose specific permission types and names. These custom file permissions will be used for file sharing, project management, and file permission control.

- File access control: File access control allows department members to set specific access permissions on files and folders to override department role permissions. This means that the access behavior of a certain file or folder in the department can be more precisely controlled. File access control only applies to department members and project members.

- High priority: File access control permissions have a higher priority. If file access control is set, it will override the member's department role permissions or project permissions. Users can set file access permissions as needed.

- Department File and Folder Control: Users can enable file access control for department files and folders to control access to specific files or folders.

- Validity period: File access control can set a validity period. After the validity period, the constraints of file access control will become invalid. For example, if a department member who does not have file editing permissions is given the editing permissions for the file, the validity period is 3 days. After 3 days, the permissions granted by the file access control will expire, and the department members' permissions on the files will become the permissions of the member role.

### Summary

The permission management of BabelBird Enterprise Drive is a comprehensive system that can meet the specific needs of different departments and projects of the enterprise. Role permissions and file permissions work together to ensure that users have precise control over file access and operations. This feature helps improve security, compliance and productivity.

## Relationship with online editors

Online editing, online editing only, client download, client editing, upload new version, and preview permissions can be combined. A typical security policy is to allow outsiders to collaborate or preview online, but not to download source files; it can also allow project members to access certain project files only within the validity period.

## Selectable permissions shown in the interface

In Enterprise Console → Permission Management (权限管理), use Department Permission List (部门权限列表) for roles and File Permission List (文件权限列表) for combinations used in sharing, projects and file access control. The sidebar also contains Management Tools (管理工具); it is not a replacement entry for these two lists.

To manage one department, department administrators can open its folder, click the blue department icon before its name in the top path bar and choose Department Management (部门管理). The same menu offers Manage Shared Files (管理分享文件), File Permission Statistics (文件权限设置统计), File Classification Statistics (密级文件统计) and File Access Statistics (文件访问统计). See the [Permissions and department management FAQ](https://www.babel.cc/public/babelwiki/en/faq-permissions.html) for the steps.

The tables group selectable permissions by file operation and management scope. The Parent item column helps you locate the corresponding group of settings. Do not use indentation or gray checkmarks alone to infer whether a child option can be changed independently, is selected automatically or takes precedence; check the current settings and effective access.

### Department role options

| Group | Interface option (Chinese label / English meaning) | Parent item |
| --- | --- | --- |
| File access | 查看别人的文件 / View other people’s files | Separately displayed item |
| File access | 上传文件 / Upload files | Separately displayed item |
| Annotations | 查看别人文件的批注 / View annotations on other people’s files | Separately displayed item |
| Annotations | 在别人文件上创建批注 / Create annotations on other people’s files | Separately displayed item |
| Annotations | 删除别人的批注 / Delete other people’s annotations | Separately displayed item |
| Hierarchy access | 查看子部门文件 / View subdepartment files | Separately displayed item |
| File operations | 打印自己的文件(下载pdf) / Print your own files (download PDF) | Separately displayed item |
| File operations | 打印别人的文件(下载pdf) / Print other people’s files (download PDF) | Separately displayed item |
| File operations | 下载自己的文件 / Download your own files | Separately displayed item |
| File operations | 下载别人的文件 / Download other people’s files | Separately displayed item |
| File operations | 分享自己的文件 / Share your own files | Separately displayed item |
| File operations | 分享别人的文件 / Share other people’s files | Separately displayed item |
| File operations | 复制自己的文件 / Copy your own files | Separately displayed item |
| File operations | 复制别人的文件 / Copy other people’s files | Separately displayed item |
| File operations | 移动自己的文件 / Move your own files | Separately displayed item |
| File operations | 移动别人的文件 / Move other people’s files | Separately displayed item |
| File operations | 删除自己的文件 / Delete your own files | Separately displayed item |
| File operations | 删除别人的文件 / Delete other people’s files | Separately displayed item |
| File logs | 查看自己的文件日志 / View logs of your own files | Separately displayed item |
| File logs | 查看别人的文件日志 / View logs of other people’s files | Separately displayed item |
| File organization | 置顶文件 / Pin files | Separately displayed item |
| File organization | 创建文件夹/项目 / Create folders/projects | Separately displayed item |
| File display | 显示不可查看文件 / Show files that cannot be viewed | Separately displayed item |
| Online editing | 在线编辑自己的文件 / Edit your own files online | Separately displayed item |
| Online editing | 给自己文件上传新版本 / Upload new versions of your own files | 在线编辑自己的文件 / Edit your own files online |
| Online editing | 给自己文件重命名 / Rename your own files | 在线编辑自己的文件 / Edit your own files online |
| Online editing | 在线编辑别人的文件 / Edit other people’s files online | Separately displayed item |
| Online editing | 给别人文件上传新版本 / Upload new versions of other people’s files | 在线编辑别人的文件 / Edit other people’s files online |
| Online editing | 给别人文件重命名 / Rename other people’s files | 在线编辑别人的文件 / Edit other people’s files online |
| Department management | 部门文件管理 / Department file management | Separately displayed item |
| Department management | 管理文件访问控制 / Manage file access control | 部门文件管理 / Department file management |
| Department management | 归档文件 / Archive files | 部门文件管理 / Department file management |
| Department management | 文件密级管理 / Manage file security levels | 部门文件管理 / Department file management |
| Department management | 批示分享请求 / Review sharing requests | 部门文件管理 / Department file management |
| Department management | 转换文件负责人 / Change file owner | 部门文件管理 / Department file management |
| Department management | 审批管理 / Manage approvals | 部门文件管理 / Department file management |
| Organization management | 子部门管理 / Subdepartment management | Separately displayed item |
| Organization management | 创建子部门 / Create subdepartments | 子部门管理 / Subdepartment management |
| Organization management | 删除子部门 / Delete subdepartments | 子部门管理 / Subdepartment management |
| Organization management | 修改子部门 / Modify subdepartments | 子部门管理 / Subdepartment management |
| Member management | 管理部门人员 / Manage department personnel | Separately displayed item |
| Member management | 增加企业成员 / Add enterprise members | Separately displayed item |

Check permissions for operations on your own files separately from those on other people’s files. Also check whether [File Owner Mode](https://www.babel.cc/public/babelwiki/en/permissions.html#file-owner-mode) is enabled and who currently owns the file; permission names alone do not define ownership. Role member counts are statistics, not selectable permissions.

### Components of custom file permissions

Each column in File Permission List is a named permission combination built by selecting rows. The options below form combinations configured by your enterprise administrator, rather than fixed defaults.

| Interface option (Chinese label / English meaning) | How to interpret it |
| --- | --- |
| 预览 / Preview | Check the actual selection in the combination’s column |
| 上传(含在线编辑) / Upload (including online editing) | Check the actual selection in the combination’s column |
| 下载 / Download | Check the actual selection in the combination’s column |
| 重命名 / Rename | Check the actual selection in the combination’s column |
| 删除 / Delete | Check the actual selection in the combination’s column |
| 批注 / Annotate | Check the actual selection in the combination’s column |
| 删除标签 / Delete tags | Check the actual selection in the combination’s column |
| 查看文件日志 / View file logs | Check the actual selection in the combination’s column |
| 文件夹专用仅上传自己的文件(含在线编辑) 可编辑(含删除) 自己的文件 / Folders only: upload your own files (including online editing); edit (including delete) your own files | Applies to folders and your own files. It does not establish permission to download other people’s files |
| 打印 / Print | Check the actual selection in the combination’s column |
| 移动 / Move | Check the actual selection in the combination’s column |
| 分享 / Share | Check the actual selection in the combination’s column |
| 仅查看文件名 / View filenames only | Check the actual selection in the combination’s column |

This describes the components of permissions, not every available combination. When selecting a combination, inspect each option selected for it in your enterprise.

You may see names such as 仅查看 (View only), 上传下载 (Upload/download), 批注讨论下载 (Annotation/discussion/download), 编辑（默认） (Edit, default), 仅上传（文件夹专用） (Upload only, folders only) and 发布 (Publish). Names are customizable and do not establish fixed factory permissions; a default marker also reflects the current enterprise configuration. For example, a combination named View only may still select upload or annotation, so its name alone does not guarantee preview-only access. Inspect each row before granting a combination, then use the target member’s account to verify allowed and disallowed operations after saving.