Access Control

Why folder permissions fall short

Shared drives grant access per folder. That works until one file belongs to several contexts at once. A product photo is part of a campaign, a product range, a regional selection and a press kit. To give each audience access, teams copy it into four folders, and the copies drift apart: one is retouched, one keeps an expired licence, one is deleted by mistake.

Asset-level access control keeps one file and decides access from two things: who is asking (their role, team, company or email domain) and what the asset is (its type, product, campaign, collection or rights status). It also separates actions. A common setup lets every employee browse previews of the whole library, lets the brand team download originals, and lets dealers download web-sized images of current products only.

Access control models

Model	Access is decided by	Example in a DAM
Role-based (RBAC)	The person's role	Editors upload and edit metadata; viewers browse and download
Group-based	Membership of a team, region or partner group	The Nordic sales group sees the Nordic price lists
Attribute-based (ABAC)	Attributes of the person and of the asset, combined in rules	People with the agency's email domain may download images tagged with the agency's campaign
Owner-based	The person who owns the file	A photographer shares a selection with one agency

Role-based access control is standardised in ANSI INCITS 359-2004, and NIST SP 800-162 (2014) describes attribute-based access control. Most DAMs combine the models: roles decide which features a person can use, and rules on asset attributes decide which assets those features apply to.

What an asset access policy covers

• Visibility: whether the asset appears in search results and collections at all.
• Preview: a full preview, a watermarked preview, or none.
• Download: whether the file can be downloaded, and at which sizes (the original, or only web-sized renditions).
• Editing: metadata changes, new versions, AI edits.
• Sharing: whether the person can send the asset outside the organisation through a link or a portal.
• Requests: whether someone without access can ask the asset owner or an administrator for it.

Setting up access control

1. List the audiences before the files: employees, the brand team, agencies, dealers, press, public visitors, and what each one needs.
2. Grant the minimum. Give each audience what its work requires (the principle of least privilege), and keep guests on the narrowest rules.
3. Base rules on metadata such as asset type, product, campaign or rights status, so new uploads are covered as soon as they are tagged. A controlled vocabulary keeps those values consistent.
4. Test a rule as a specific person before it goes live.
5. Review access when people leave or a partner contract ends. Single sign-on lets you remove a person's access in one place.

Access control in Freedam

• Roles grant features such as upload, metadata editing, deletion, download, sharing and administration. A role can inherit the permissions of a parent role.
• Asset access rules combine conditions on the person (user group, role, email domain, or portal guest) with filters on the asset (metadata fields, asset class, collection, workflow status or rights policy). Rules are evaluated in priority order, and the first rule that matches both the person and the asset applies. A rule that cannot be evaluated denies access.
• Each rule sets visibility, preview (full, watermarked or none), the download sizes allowed, AI editing, and whether a download needs approval from the asset owner or the admin team. It can also ask people to state the intended use, or accept a notice, before they download.
• The access tester shows which rules match a given user or a portal guest, and whether that person can reach a given asset.
• Visitors to a brand portal are covered by the same rules, through a built-in guest rule that administrators can override.
• Share links can be public, limited to listed email addresses or domains, password-protected or private, with a start date, an expiry date, a maximum download size and a watermark.
• People can sign in with Google or Microsoft, and new accounts from listed email domains receive the role set for that domain.
• Changes to access rules, roles and user groups are recorded in the audit trail. The governance page gives an overview.

Frequently asked questions

What is the difference between authentication and access control?

Authentication confirms who a person is, with a password or single sign-on. Access control decides what that person may do once signed in. A DAM needs both: single sign-on alone would give every employee the same access to the whole library.

What is the difference between RBAC and ABAC?

Role-based access control grants permissions by role, such as editor or viewer. Attribute-based access control evaluates attributes of the person and the asset, such as department, region, campaign or licence status. RBAC is simpler to set up. ABAC handles exceptions without a new role for each one.

Do partners and agencies need their own accounts?

Agencies that upload files or work in the library regularly need accounts in their own group. Dealers and press who only download are usually served through a portal or a share link, governed by guest rules, so there are no accounts to manage.