Negative Permissions

Negative permissions, also called "negative ACLs", are explicit "deny" rules. Some systems use them to override inherited “allow” rules.

Files.com uses allow-only permissions. Users (except site administrators) and groups start with no access.

Some directory systems support negative permissions. Files.com cannot synchronize "deny" rules from those systems because Files.com uses allow-only permissions. Allow-only permissions help administrators implement security schemes that make sense because users, groups, and partners only have the permissions that have been explicitly granted.

During migrations, you can use permission fences to block inherited allow permissions at a folder boundary.

Permission fences do not create an explicit "deny" rule. They are not a general replacement for negative ACLs.