Fine-grained permissions
Seventy-seven distinct permissions across assets, collections, brand, AI, admin, and operations. Compose roles that match how your team actually works.
Built for the team running the library
The shape of who can do what
Granular permissions, hierarchical user groups, smart access rules, watermarks, share-link controls, and dashboards. Run a busy library without the busywork.
Six pillars of operational governance
Access control, asset protection, and visibility, wired into every layer of your library.
Hierarchical user groups
Nest groups inside groups. Assign roles once at the parent and let inheritance handle the rest. Onboarding scales without per-user fiddling.
Smart access rules
Combine user attributes with asset filters to drive policy automatically. Optional request workflow when someone needs an exception.
Watermarks at the boundary
Dynamic watermarks with placeholders for user, date, and custom text, applied on previews, downloads, and shares.
Share controls that hold up
Passwords, expiry, allowed emails or domains, embed allow-lists, and watermark binding, every external link is configured, not improvised.
Activity log & analytics
See what your team actually did, uploads, edits, deletes, shares, alongside dashboards covering asset performance and search trends.
Permissions
Compose roles that match how your team actually works
Seventy-seven granular permissions across every meaningful action. Pick the ones a role needs, save it, assign it. Nobody gets “admin or nothing.”
Role assignments themselves are audited. When a permission is granted or revoked, you know who, when, and why.
Permission groups
- Assets9 permissions
- Collections6 permissions
- Pages & brandingincl. themes, brand guides
- AI & Studioincl. AI cost controls
- Workflowsincl. request approvals
- Faces & metadataincl. taxonomy
- Admin & operations45 permissions
Group hierarchy
Path
Marketing → Brand Studio → Photographers
Inherited from parent groups
- Asset upload
- Asset replace
- Apply watermark
- Share with brand portal
Set on this group only
- Auto-tagged with "photography" upload metadata
User groups & SSO
Manage access at scale, not user-by-user
Hierarchical groups inherit permissions down the tree. Assign a role at “Marketing” and every team inside it gets it, unless you override deliberately.
Groups work on every plan. Single sign-on through your existing identity provider, Google Workspace or Microsoft Entra, comes with the Business plan, so onboarding a new hire is the same workflow as the rest of your stack.
Smart access rules
Express the policy your business actually has
Rules combine user conditions with asset filters to enforce policy automatically. Hide embargoed assets from contractors, route requests through approval, or quietly apply different watermarks to different audiences.
Rules are prioritized, named, and testable, not a tangle of one-off ACLs that nobody can read.
Access rule
Name
Hide unreleased product imagery from external contractors
When
- User is in any group whose name starts with "External"
- AND asset has metadata field "release_status" = "embargo"
Then
- Hide from search results
- Block download
- Allow request with approval workflow
At the boundary
Protect assets when they leave your library
Watermarks and share-link controls compose together. The link decides who comes in; the watermark decides what they take with them.
Password protection
Optional password on any external share, bcrypt-hashed and never stored in plain text.
Allowed emails & domains
Restrict who can open the link by email address or by email domain. Both lists, or either, or neither, your call.
Expiry & link rotation
Every share can carry an expiration date. Expired links return a clean 410, not a leaked download.
Watermark binding
Bind a watermark to the share itself, every download from this link is stamped, no matter who pulls it.
Embed allow-list
Decide which hostnames may iframe-embed the share. Browsers refuse to render it elsewhere.
Per-share access log
Every visit logged, who, when, from where. Full audit trail for the lifetime of the link.
- Group-targeted access, share with whole teams, not lists of people
- Per-user access overrides when you need an exception
- A dedicated audit log just for internal share activity
- Expirable internal shares for time-bounded campaigns
Internal shares
Internal sharing, made accountable
Sharing inside the organization is its own surface, with its own audit log. Permission grants, group changes, and access events are all captured, even when the asset never leaves the building.
Analytics
Reports leadership actually opens
Built-in dashboards across asset performance, search behaviour, ingestion workflows, and AI spend. Custom dashboards when leadership wants their own slice.
- Asset performance, views, downloads, share opens per asset and collection
- Search trends, what people ask for and what they don’t find
- Workflow metrics, ingestion, approvals, request response times
- AI cost dashboards, spend by model, by team, by operation
- Custom dashboards, mix and match the metrics your leadership cares about
- Uploads, deletes, replaces, and version creations
- Metadata edits, taxonomy changes, face tagging
- Collection membership changes and internal share access
- External share creation, password changes, expiry adjustments
- Permission and role assignment changes
- API token usage, separate audit log for programmatic access
Activity log
The operational record, separate from the rights audit
Every meaningful action your team takes is captured here. Different from the rights audit log: that one answers “was this allowed?”, this one answers “what happened, and who did it?” Both live side by side.
Programmatic access has its own audit log too, every API token call recorded, scoped, and filterable by ability.
Production-grade · Start free today
Run your library, don't referee it
Permissions, groups, watermarks, share controls, and dashboards, all in one place, from day one.