--- title: "Setting up access control for different Drive users" slug: "setting-up-access-control-for-different-drive-users" tags: ["file manager", "drive", "folder", "file"] updated: 2024-10-17T11:37:33Z published: 2024-10-17T11:37:33Z canonical: "support.lusid.com/setting-up-access-control-for-different-drive-users" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.lusid.com/llms.txt > Use this file to discover all available pages before exploring further. # Setting up access control for different Drive users In this tutorial we'll see how to set up access control for different LUSID users so they can [operate Drive](/v1/docs/how-do-i-upload-and-manage-files-in-drive). The goal is to give them exactly the permissions they need to perform their professional responsibilities, and no more. > [!NOTE] > Note > > To complete this tutorial, you must yourself have suitable permissions. This can most easily be achieved by assigning your LUSID user the built-in `lusid-administrator` role. This should already be the case if you are the domain owner. The users are: - An *Administrator* who needs to upload, edit and delete files, and organise folders. - An *Operator* who just needs to see a list of available files and download them on an *ad hoc* basis. This tutorial assumes these users already exist in LUSID. [See how to onboard users](/v1/docs/onboarding-users-into-lusid). > [!NOTE] > Note > > Once permissioned, users can interact with Drive either via the LUSID web app or by calling the API directly; the access control system makes no distinction between these two workflows. ## Step 1: Understanding access control in LUSID LUSID's powerful role-based access management system consists of [users](/v1/docs/what-are-a-personal-user-and-a-service-user), [roles](/v1/docs/what-is-a-role), [policies](/v1/docs/what-are-a-policy-and-a-policy-collection) and [policy collections](/v1/docs/how-do-i-create-a-policy-collection). In summary: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(209).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) An individual policy manages access to *features* and/or *data*: - A feature policy controls access to [Drive API](https://www.lusid.com/docs/api/drive/intro) endpoints. This is irrespective of whether a user ultimately interacts with Drive via the LUSID web app or by calling the API directly (since the web app itself calls the API). - A data policy controls access to information about files and folders. To perform any real-world operation in Drive, a user must be assigned both types of policy. This is because a data policy without an equivalent feature policy cannot perform operations, and a feature policy without an equivalent data policy yields no data. For more on identity and access management (IAM) in the LUSID platform, see our [IAM documentation](/v1/docs/identity-management-and-access-control-iam). ## Step 2: Defining the roles and policies we want to create For our users, we need the following: | **User** | **Role** | **Policies** | | --- | --- | --- | | Administrator | `drive-admin` | `drive-features-data-all` | | Operator | `drive-operator` | `drive-features-data-files-download` | ## Step 3: Creating a policy for the Operator Let's start with the Operator and the `drive-features-data-files-download` policy. > [!NOTE] > Note > > We'll create this policy using the LUSID web app, but it could equally be created by calling the [Access API](https://www.lusid.com/docs/api/access/intro). The Operator requires access to Drive API endpoints that list files and download them (features), as well as read-only access to information about files (data). They don't need access to API endpoints that upload or edit files or create folders. 1. Sign in to the [LUSID web app](https://www.lusid.com/app/home) using the credentials of a LUSID administrator. 2. From the left-hand menu, select **Identity and access > Policies**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(210).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) 3. On the **Policies** dashboard, click the **Create policy** button. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(211).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) 4. Specify a unique **Code** for the policy: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(212).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) 5. On the **Features** tab, select the appropriate API endpoints: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(213).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D)Selecting precisely which API endpoints is subjective, but to enable the Operator to list files and download them, you might choose: `DownloadFile`, `GetFile`, `GetFolder`, `GetFolderContents`, `GetRootFolder` > [!NOTE] > Note > > For the Administrator, it would be reasonable to select *all* API endpoints. API endpoints are identified by their operation ID. Examine the [Drive API reference](https://www.lusid.com/docs/api/drive/intro) for more information on each endpoint; the operation ID is printed under the URL: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(225).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) 6. Click **Next** to reach the **Data Resources** tab. Under **Drive** **> File** and **Drive > Folder**, select the checkboxes for **Read** and **List**. This allows the Operator to see all files in the root folder and in subfolders but prevents them from uploading or editing files: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(215).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) > [!NOTE] > Note > > For the Administrator, it would be reasonable to select **Any**, which grants read-write access. 7. For **File**, choose the **Selector** option **Identifier** and specify a value of `*` for both **File path** and **File name** to grant access to any file in any folder in Drive: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(216).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D)If you wanted, you could restrict access to just a particular file, or files in particular folders, by specifying appropriate values. Note this dialog accepts wildcards: For example, you could specify a **File path** of `/Instruments` and a **File name** of `trade*` to restrict the Operator to seeing just files with names beginning `trade` in folders named `Instruments`. - `*` matches all - `*.txt` matches all files with that extension - `secret*` matches all files beginning `secret` 8. For **Folder**, choose the **Selector** option **Identifier** and specify a value of `*` for both **Folder path** and **Folder name** to grant access to the root folder and any subfolder: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(217).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D)If you wanted, you could restrict access to just a particular folder(s) by specifying appropriate values. Note this dialog accept wildcards: - `*` matches all - `/*` matches the root folder and any subfolder - `/Marketing` matches a folder named `Marketing` under the root folder - `/Operation*` matches a folder named `Operation` under the root folder and any subfolder. 9. Create the policy: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(218).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) > [!TIP] > Exercise > > Can you create the feature and data policy for the Administrator? ## Step 4: Creating a website policy for the Operator There's a special policy we need to create for any user who intends to interact with Drive using the LUSID web app. > [!NOTE] > Note > > You can skip this step if your users will only interact with Drive by calling the Drive API. This policy enables access to the **Data Management > Drive** menu. Without it, the **Drive** menu option is not visible, and the user cannot navigate to the **Drive** dashboard: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(219).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) The policy is the same for every user. Copy the following JSON document and [follow these instructions to create the policy](/v1/docs/how-do-i-create-a-policy-from-a-json-document): ```json {    "description": "Allow access to the Data Management > Drive menu option",    "applications": [        "Website"    ],    "grant": "Allow",    "selectors": [        {            "idSelectorDefinition": {                "identifier": {                    "code": "drive",                    "scope": "data-management"                },                "actions": [                    {                        "scope": "default",                        "activity": "view",                        "entity": "data-management"                    }                ]            }        }    ],    "when": {        "activate": "2020-07-15T22:00:00+00:00",        "deactivate": "9999-12-31T23:59:59.9999999+00:00"    } } ``` The Operator now has a feature and data policy, and the special website policy to allow UI access, ready to assign to their role. ## Step 5: Creating a role for the Operator Now we need to create a suitable role, since policies are assigned to roles rather than directly to users. A role should represent an aspect of that user's professional responsibilities; you can divide these responsibilities into one or many roles, depending on your needs. We'll create a single drive-operator role for this user, encompassing their entire responsibilities: 1. Navigate to the **Roles** dashboard. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(220).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) 2. Click the **Create role** button (top right). 3. Specify a unique **Code** for the role, and then assign the appropriate policies from the **Policies > Choose** dropdown: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(221).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) 4. Create the role. Note that roles have a precedence, so if you do assign two roles to a person and those roles contain conflicting policies, the role with the highest precedence takes effect. > [!TIP] > Exercise > > Can you create a role for the Administrator? ## Step 6: Assigning the role to the Operator user The last step is to assign the `drive-operator` role to the LUSID user representing this person. To do this: 1. Navigate to the **Identity and Access >** **Users** dashboard. 2. Find the appropriate user row and click the **Edit** icon: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(222).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) 3. Click the **Add roles** button to assign the appropriate role to the user: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(223).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) ## Helping users get started The Operator can now interact with the LUSID web app. Tell this person to navigate to your LUSID domain (for example `https://acmecorp.lusid.com/app`) and sign in using their own account credentials. This person should be able to navigate to the **Data Management > Drive** dashboard, see files and download them. Other operations will not be available: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(224).png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A51%3A10Z&se=2026-11-11T05%3A51%3A10Z&sr=c&sp=r&sig=VVEcJlqrWz6cjNXJF0pWnH9kpZ64gYeswe%2BtQWAvw1A%3D) To interact with Drive programmatically: - Using the [Drive REST API](https://www.lusid.com/docs/api/drive/intro), tell the Operator to first [follow these instructions](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta) to obtain an API access token. Note the API reference hosts a pre-authenticated sandbox where they can [try out any FINBOURNE API](/v1/docs/getting-started-with-the-lusid-rest-api-and-sdks). - Using an appropriate version of the [Drive SDK](/v1/docs/understanding-all-the-applications-in-the-finbourne-platform), tell the Operator to first [follow these instructions](/v1/docs/how-do-i-use-an-api-access-token-with-the-lusid-sdk) to assemble credentials and authenticate securely.