Category Level Permission (CLP) allows administrators to control user group actions within specific categories, balancing collaboration and confidentiality for sensitive files, folders, and categories.
CLP is ideal for multi-team environments, since each category can now act as a team- or project-specific library, ensuring only authorized users have access to their respective categories. CLPs provide the following options when applied to a category:
CLP Upload: Ensures that only user groups with the upload permission are able to upload assets to the given category.
CLP Download/Share: Enables all users to discover assets within the given category while preventing downloading and sharing of assets, unless the user is a member of a group with the Download/Share CLP for that category. Users without the Download/Share permission must contact an Administrator for the ability to download or share assets in that category.
How to access it
Administrators can click on the “Permissions” button on the “Groups” tab to be redirected to the CLP menu.
To do this:
- As an administrator, select Settings from the left-side menu.
- Select the Categories tab.
How it works
Once you have accessed the Categories tab, you will be presented with your category structure. To set up CLP, please click on the Permissions column next to your desired category/sub-category.
Once opened, you will see the following:
To change a group’s ability to download/share or upload to this category, click on the “Select” drop-down next to the group’s name, and select your desired option under Upload or Share and Download. Please note that you are not required to have a selection for both options in order to save your preference.
When setting up CLP for a parent category, please click on the “Apply permission to all categories belonging to this category” to apply the same rules to all sub-categories associated. This is also referred to as “Permission Inheritance”.
If you don’t select the permission inheritance option, remember to individually set up CLPs for each sub-category.
To apply CLP for more than one group at once, select all the desired groups and utilize the “Bulk Edit” option
Once you are satisfied with your selection, click Save to apply your changes.
To view your CLPs at a glance, click on the category/sub-category name. Once selected, you can quickly view which groups have upload permissions, which do not, and which groups do not have pre-defined permissions.
End-User Perspective
If a group’s CLP is set to to Cannot Upload, the category will be greyed out when the user attempts to upload an asset to a specific category.
When selecting Actions followed by Add Categories, the user also won’t be able to add an asset to the categories that they don’t have upload permission to:
If a user does not have Download and Share permissions for a certain category, the Download button for those assets will be greyed out
Additionally, upon attempting to share assets, users will receive the following message:
Portals and CLP Permissions
When syncing content to a Portal, CLP (Category-Level Permissions) policies are enforced based on the share permissions defined for your user group. This determines which categories you can sync and which individual assets you can add to a portal section.
• Syncing a category: If your group has a CLP download/share restriction on a category, the Sync selected category toggle for that category will be disabled, with a tooltip explaining the restriction. Categories you're permitted to sync remain available.
• Adding individual assets: When adding assets to a portal section, you won't be able to add an asset that's assigned to a category your group is restricted from — even when you're browsing the asset from a category you do have access to. The blocked asset will show a tooltip indicating the restriction.
Note about Collections: If your group has any CLP download/share Deny policy applied anywhere in your account, the Sync selected Collection toggle will be disabled on all collections, regardless of which categories the collection's assets belong to. To sync a specific collection, an admin will need to remove the relevant CLP Deny policy. Alternatively, you can add assets to your section manually via the Categories tab, where the per-category restrictions described above apply.
Note: When using CLP, please be mindful of the following:
- Giving access to a group that does not have access to that category (via group permissions) does not override those permissions. We recommend that administrators correctly set up group permissions via the “Groups” tab prior to utilizing CLP
- We recommend refreshing the page to ensure that the CLP policy takes place.
- If an asset is located in two or more categories, and a user group does not have Download and Share access to one of those categories, the download and share functions for that asset will not be accessible in any of the categories it exists in. To avoid confusion, we recommend placing all sensitive assets in the same CLP-restricted category