--- title: Object Permissions & Custom Roles slug: author/object-permissions-and-custom-roles docTags: createdAt: 2025-03-11T06:56:11.036Z --- You can create and edit object permissions in conjunction with Custom Roles to meet the organizational needs of a large digital signage network where pricing and offerings may vary by regions and/or stores. In this scenario, you may need to limit or allow access according to the objects (Media files, Dynamic Playlists, etc.) themselves. See [Restrict/Allow Access in Author Plus](docId\:qikGFspJ_RLIErSJ0pXne) for examples of how to use object permissions. ![Screenshot 2024-10-31 at 2.23.02 PM.png](https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/p6FamRKKSUumwBOfdbBn-_screenshot-2024-10-31-at-22302-pm.png) Object permissions are accessed through the **Security** section of the **Properties** panel when you select an object. This is on the right side of the screen in **Network**, **Content**, or **Presentations** tab (for player, content, or presentation properties). 1. Select the **Security** section of the **Properties** panel. 2. Assign object permissions by role or by user: 1. In the **Assigned Roles** section, select the desired role (remember that you can only edit permissions for Custom Roles). 2. In the **Assigned Users** section, select the desired user. 3. If the toggle is enabled, you can click on it to create an allowing or denying permission to execute a given operation under the current object. :::hint{type="info"} Permissions settings for users have higher priority than those for roles, and permissions for objects have higher priority than those for operations. For example, if the **Presentation Creators** role has a denying permission to manipulate **Live Text** feeds, but one of its members has **Full** **Control** access to a particular **Live Text** feed instance then the allowance for that specific object takes precedence over the general restriction for **Presentation Creators**. ::: # User Permissions & Roles User permissions and roles follow rules as described below. ## No Permissions When permissions are not granted either to a user or that user’s current role, the toggle switches are grey but active and do not have a delete icon. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/VMAvV_aVYtk6qmGjwtks5_shot6.png" size="50" width="765" height="921" position="center" alt="Shot6.png" darkWidth="765" darkHeight="921" showCaption="false"} In this example, the selected user doesn’t have any permissions to execute content-specific operations and has no inherited permissions from their role. ## Explictly Defined Permissions When a specific role or user has an explicitly defined permission to execute a particular operation under the given object, the enabled/disabled toggle will be shown in the enabled state with a delete (trashcan) icon next to it. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/CD5OCDOCbeOS9RIvFy1qC_shot1.png" size="50" width="861" height="696" position="center" alt="Shot1.png" darkWidth="861" darkHeight="696" showCaption="false"} In this example, the members of the **Content Managers** role are explicitly allowed to view a particular file (**View** **Content**) but not allowed to change it (**Update** **Content**). You can delete these permissions by clicking on the delete icon which will put inherited permissions into effect instead. ## Parent / Child Permissions When a specific role or user has an explicitly defined permission to execute a parent operation under the given object, the toggles on the all the child operations will have the same enabled/disabled state but no delete icon. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/kTz1jhudw1ixucgYSnjrN_shot2.png" size="50" width="870" height="939" position="center" alt="Shot2.png" darkWidth="870" darkHeight="939" showCaption="false"} In this example, the members of the **Content Managers** role have **Full Control** permission which applies to all child operations as well. ## Roles & Objects When permission is granted to any role on the **Admin > Roles** page, it automatically applies to all objects of a given type and is displayed with an active enabled/disabled toggle but without a delete icon. ::::VerticalSplit{layout="middle"} :::VerticalSplitItem ::Image[]{src="https://api.archbee.com/api/optimize/0prk6SO2dy9LdU77jB8D1/A0ZHoqwfrQwy1bOJNwIOe_image.png" size="80" width="1280" height="1227" position="center" caption="Operation permissions for Content Managers" darkWidth="1280" darkHeight="1227" showCaption="true"} ::: :::VerticalSplitItem ::Image[]{src="https://api.archbee.com/api/optimize/0prk6SO2dy9LdU77jB8D1/55CZ9PVH0a9lxQXUrrsYR_image.png" size="80" width="1280" height="1395" position="center" caption="Object permissions for Content Managers" darkWidth="1280" darkHeight="1395" showCaption="true"} ::: :::: In this example, the members of the **Content Managers** role have permission to view all files and manage their tags which is reflected in the **Security** tabs of all the files which do not have an overriding permissions. The same applies when you grant any permission to a parent folder of a given file. ## Roles & Users When permission is granted to any role on the **Admin > Roles** page, it automatically applies to all the users assigned to this role and is displayed with an active enabled/disabled toggle but without a delete icon. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/liFplWejhMzTmBD8pqSUt_shot4.png" size="50" width="771" height="924" position="center" alt="Shot4.png" darkWidth="771" darkHeight="924" showCaption="false"} In this example, the selected user is a member of the **Content Managers** role and that is why they have permissions to see a particular file and manage tags despite the fact that no permission is granted specifically to this user. ## System Roles Permissions granted to **System Roles** apply to all objects of a given type and are displayed with active enabled/disabled toggles without delete icons but are not editable. ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/92oHz1s-76d043Vv4POJN_shot5b.png" size="50" width="765" height="1152" position="center" alt="Shot5B.png" darkWidth="765" darkHeight="1152" showCaption="false"} In this example, you can see that the members of the **Creators** role have almost all permissions under the given object but you cannot override any of them. The same applies to specific objects like your home folder or the “Disabled Players” group.