Limiting access so user can move content but not delete.

Question

We have a security need in the OAC Classic Catalog - users need to be able to move content between folders but not be able to delete content from specific folders.

Setting the role to Custom permissions and unchecking Delete leads users unable to move or rename content.

Is there a Permissions setting that would allow for editing/renaming/moving but not deleting?

Gianni Ceresa · Accepted Answer

The permissions that exist on the (classic) catalog are those you see, there aren't more permissions somewhere else.

Moving an object is a mix of permissions: write in the destination folder + delete in the source folder. Therefore if you want a proper "move" action, the permission to delete is required. The only way to not allow the delete is that instead of moving people will need to copy. But there isn't a permission that touch moving itself.

The same applies to all the other actions you mention. Renaming can be seen as a copy + delete, therefore the delete permission still play a role. Otherwise you grant only a write permission and people will be able to copy and save with the new name, but the original object will still be there because can't be deleted.

The only action you mention that doesn't require delete is the editing: that one only requires the write permission.

Keeping it short: the permissions you see in the catalog are already the finest granularity of permissions existing, all the actions available (or not) are based on a combination of those permissions. And the 'delete' permission is implicitly required in a number of actions like moving and renaming. If you want your users to be able to move and rename, they should be able to delete (because by moving and renaming the result would be the same as a delete for the consumers).