> For the complete documentation index, see [llms.txt](https://docs.zata.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zata.ai/manage/bucket/access-control.md).

# Access Control (ACL)

Decide who can see your file list, who can download your files and who can upload

Access Control decides **who can see, download and change the things you store in Zata.ai**.

There are two separate settings, and each one does a different job:

* **Bucket ACL** — can people see the **list of files** in your bucket, and can they **upload** to it?
* **Object ACL** — can people **download** a particular file?

You set them in two different places, and changing one never changes the other.

> **INFO** Think of a bucket as a folder. The bucket setting decides whether people can look inside the folder and read the file names, and whether they can put new things in. The object setting decides whether they can actually open a file.

***

## The one rule to remember

**Making a bucket public does not make your files downloadable.**

Someone can see that a file called `invoice-2026.pdf` exists and how big it is, but the download is refused until you make that file public too.

**Making a file public does not show people the rest of your bucket.**

They can open the file you shared, and nothing else.

So if you want visitors to browse your files *and* download them, you have to turn on both settings.

***

## Where to find each setting

| Setting    | Where you change it                                           | The question it answers                            |
| ---------- | ------------------------------------------------------------- | -------------------------------------------------- |
| Bucket ACL | **Bucket > Bucket Settings > Access Control**                 | Who can see the list of files, and who can upload? |
| Object ACL | **Bucket Details > Actions (⋮) > Make public / Make private** | Who can download this one file?                    |

Each one has its own page:

* [**Bucket ACL**](/manage/bucket/access-control/bucket-acl.md) — set your bucket to Private, Public read, Authenticated User, or one of the two write settings.
* [**Object ACL**](/manage/bucket/access-control/object-acl.md) — make a single file public or private, and copy its link.

***

## Your choices

**For a bucket**, you pick one of five. The first three are read-only; the last two also let other people upload.

| Option                              | Who can see the file list                                                   | Who can upload, overwrite and delete    |
| ----------------------------------- | --------------------------------------------------------------------------- | --------------------------------------- |
| **Private**                         | Only you. This is the default.                                              | Only you                                |
| **Public read**                     | Anyone on the internet, with no sign-in                                     | Only you                                |
| **Authenticated User**              | Anyone signed in to *any* Zata.ai account — not only people in your account | Only you                                |
| **Public read + write**             | Anyone on the internet                                                      | Anyone on the internet                  |
| **Authenticated User read + write** | Anyone signed in to any Zata.ai account                                     | Anyone signed in to any Zata.ai account |

**For a file**, you pick one of two:

| Option      | Who can download it                                            |
| ----------- | -------------------------------------------------------------- |
| **Private** | Only you. This is the default for every upload.                |
| **Public**  | Anyone with the link, with no sign-in. The link never expires. |

> **IMPORTANT** The two write settings let other people **overwrite and permanently delete** your files, not just add new ones — upload and delete are a single S3 permission. Read [Write access](/manage/bucket/access-control/bucket-acl.md#write-access) before you turn either one on.

***

## What a visitor can actually do

Here is what someone **with no Zata.ai account** can do, for each combination of the read-only settings:

| Bucket setting     | File setting | Can they see the file list? | Can they download the file? |
| ------------------ | ------------ | --------------------------- | --------------------------- |
| Private            | Private      | No                          | No                          |
| Private            | Public       | No                          | Yes, if they have the link  |
| Public read        | Private      | Yes                         | No                          |
| Public read        | Public       | Yes                         | Yes                         |
| Authenticated User | Private      | No                          | No                          |
| Authenticated User | Public       | No                          | Yes, if they have the link  |

With **Authenticated User**, visitors cannot see the list — but anyone signed in to a Zata.ai account can.

The two write settings behave like their read-only versions in this table, and add the ability to upload, overwrite and delete.

***

## When ACL is not the right tool

An ACL is all-or-nothing: it opens your bucket to *everyone* in a group, and you cannot pick individual people or folders. When you need that kind of control, use one of these instead:

| What you want to do                                                  | Use this                                                                                                                                      |
| -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Share one file with someone for a limited time                       | [Presigned URL](https://docs.zata.ai/manage/bucket/storing-objects-in-a-bucket/sharing-an-object-using-presigned-url) — it expires on its own |
| Give a colleague ongoing access you control                          | [Subuser](https://docs.zata.ai/subusers/create-a-subuser) with a [policy](https://docs.zata.ai/subusers/create-a-subuser/policies)            |
| Let a specific person upload, without opening the bucket to everyone | [Subuser](https://docs.zata.ai/subusers/create-a-subuser) with a write policy                                                                 |
| Share only one folder, not the whole bucket                          | [Bucket Policy](https://docs.zata.ai/manage/bucket/bucket-policy-configuration)                                                               |

***

## Good to know

> **IMPORTANT** A public file list shows your file names to everyone. File names often contain customer names, invoice numbers or project names, so treat the list itself as information worth protecting — even when the files stay private.

* Both browsing and downloading count towards your egress usage. See [Ingress and Egress Policy](https://docs.zata.ai/account/ingress-and-egress-policy).
* All public access stops working if your account is suspended.
* You can switch any of these settings back at any time — but switching off write access does not undo anything that was already uploaded or deleted.
* A bucket policy can block public access even when the ACL allows it. If a setting seems to have no effect, see [ACL and bucket policies](#acl-and-bucket-policies) below.

***

## ACL and bucket policies

Zata.ai checks the ACL **and** your bucket policies. If a policy says no, the answer is no — a policy that blocks access always wins over an ACL that allows it.

The Access Control section repeats this on screen:

> **NOTE** The Public Access toggle above writes a bucket policy — an explicit Deny there overrides this.

So if you set a bucket to **Public read** and nothing changes, check the **Security & Access** section of Bucket Settings and the **Policies** page for a rule that is blocking it.

***

## If you use the S3 API

Zata.ai follows the standard S3 ACL model, so the dashboard options match standard S3 permissions:

| Dashboard option                | S3 canned ACL        | Who it grants access to                                                |
| ------------------------------- | -------------------- | ---------------------------------------------------------------------- |
| Private                         | `private`            | The owner only                                                         |
| Public read                     | `public-read`        | READ for the `AllUsers` group — everyone                               |
| Authenticated User              | `authenticated-read` | READ for the `AuthenticatedUsers` group — every signed-in Zata.ai user |
| Public read + write             | `public-read-write`  | READ and WRITE for the `AllUsers` group                                |
| Authenticated User read + write | *no canned name*     | READ and WRITE granted explicitly to the `AuthenticatedUsers` group    |

In S3, "read" means different things depending on what the ACL is attached to:

* On a **bucket**, read means *list the objects*.
* On an **object**, read means *download the contents*.

Same permission name, two different results. That is the reason the two settings have to be applied separately.

WRITE has no such split — it exists only on a bucket, and it covers adding, replacing and deleting objects together. That is why Zata.ai cannot offer an upload-only setting.