Creative permissions and access
Two layers: Wevion RBAC (in-app visibility by role — admin all, owner self+team, others own) plus Drive folder sharing. No creative_* audit actions.
Written By Salvatore Sinigaglia
Last updated 19 days ago
Two layers: Wevion RBAC (in-app visibility by role — admin all, owner self+team, others own) plus Drive folder sharing. No creative_* audit actions.
Creative permissions and access
Creative Hub access is governed by two independent layers. Layer 1: Wevion RBAC controls in-app visibility — super_admin / admin see all users, owner sees self + their team, every other role sees only their own. Layer 2: Google Drive permissions control external direct access via the Drive UI (folder-level
writershare). Note: Creative Hub actions are not written to the Wevion audit log. This is the admin-facing summary; mechanics in Google Drive RBAC.
Who is this for
Admins setting up team folder structures. Owners reviewing creative access for compliance. Anyone needing a single page to understand who can see what.
Permission matrix
Wevion in-app visibility
Wevion filters what you can see by your role before responding. There is no separate visibility flag — the role decides visibility directly.
Google Drive external sharing
Granted to specific emails via Drive permissions API. Independent of Wevion roles.
Action-by-action permissions
Audit log
Creative Hub actions are not written to the Wevion audit log — there are no creative_* audit actions in the code (no creative_view, creative_upload, creative_delete, creative_share, creative_generate, etc.), and there is no creative_hub_file table to attach them to. To see who currently has external access to a user's folder, use the shared-emails list. The general audit log covers non-Creative-Hub lifecycle events.
Permission inheritance
Folders → contents
When you share externally (Drive), you grant access to the user's whole Creative Hub folder and everything inside it (Drive default cascade) — there is no per-file share.
Wevion in-app visibility follows the role rules above (super_admin / admin all, owner self+team, others own); it isn't a per-folder toggle.
No per-file share
There is no per-file share. The share flow grants writer on your entire folder. To share only a subset, keep those assets in a separate account/folder or share them directly from Google Drive.
Common admin tasks
Onboard new mediabuyer
- Create user (via team-103 invite-member)
- Mediabuyer's
ensureUserFolder()triggers on first upload (creates Drive root automatically) - Optionally: share team brand-assets folder with new user
- Set credit cap if budget control needed
Offboard departing member
- Audit their Creative Hub folders: super_admin / admin (all) or owner (their team) views via the Members switcher
- Transfer or archive important files (move to a team archive folder)
- Revoke their session (via Roles and permissions — full reference)
- Their files remain in Drive (owned by Service Account) — no data loss
- Review external shares they granted via the shared-emails list
Periodic compliance review
- List active external Drive grants via the shared-emails list
- Review with owners — revoke stale grants
- Check team_credit_cap usage trends — adjust caps if needed
"Who deleted this file?"
There is no creative_delete audit action, so Wevion cannot attribute a deletion. Deletes move the item to Google Drive trash (trashed: true), so recovery is via Drive's trash within its retention window — check Drive directly.
Limits + caveats
- Wevion RBAC doesn't grant Drive access: a super_admin/admin seeing another user's file in Wevion does NOT mean they can open it in the Drive UI. For Drive access an explicit Drive share is required.
- Non-privileged roles see only their own folder: manager, mediabuyer, finance, and viewer see only their own Creative Hub folder (owner adds their team; super_admin/admin see all).
- External share is folder-level: sharing grants access to the user's whole folder, not a single file.
- Service Account owns everything: file ownership cannot be transferred to a user. This is intentional (clean offboarding).
Common mistakes
- Confusing Wevion visibility with Drive access: independent layers; read Google Drive RBAC carefully
- Sharing externally instead of using team folder: for teammates, internal mechanism is cleaner
- Forgetting to revoke departed member's external shares: data leak risk
- Setting credit cap too high "to be safe": defeats purpose; set conservative + raise on demand
FAQ
Who can see teammates' files in Wevion's Creative Hub?
super_admin and admin can see every user's folders and files in Wevion's Creative Hub; an owner sees their own plus their team members'; every other role (manager, mediabuyer, finance, viewer) sees only their own folder. Visibility is enforced server-side, filtering listings by role before responding. There is no canViewTeam flag.
Does Wevion in-app visibility give someone access to the file in Google Drive?
No — the two layers are independent, so a super_admin or admin seeing another user's file in Wevion does not mean they can open it in the Drive UI. Wevion RBAC controls in-app visibility, while Google Drive permissions control external direct access. To grant Drive access you must create an explicit Drive share (folder-level, writer) to a specific email.
What happens to a departing member's Creative Hub files when I offboard them?
Their files remain in Drive with no data loss, because the Service Account owns everything and ownership cannot be transferred to a user. Before revoking their session, audit their folders via the Members switcher (as super_admin/admin/owner), transfer or archive important files, and review external shares they granted via the shared-emails list so you can revoke stale grants.
Are Creative Hub actions recorded for compliance?
No — Creative Hub actions are not written to the Wevion audit log. There are no creative_* audit actions in the code (no creative_view, creative_upload, creative_delete, creative_share, creative_generate) and no creative_hub_file table. For external access, the shared-emails list shows the current grants; AI generations are recorded as rows in the creative_job table.
What can the finance role do in Creative Hub?
The finance role sees only its own Creative Hub folder — like manager, mediabuyer, and viewer, it has no cross-user visibility. Only super_admin/admin see all users, and owner sees their team. So finance can use its own folder but can't browse others' creatives unless a folder is explicitly shared with it via Drive.
FAQ
Who can see teammates' files in Wevion's Creative Hub?
super_admin and admin can see every user's folders and files in Wevion's Creative Hub; an owner sees their own plus their team members'; every other role (manager, mediabuyer, finance, viewer) sees only their own folder. Visibility is enforced server-side, filtering listings by role before responding. There is no canViewTeam flag.
Does Wevion in-app visibility give someone access to the file in Google Drive?
No — the two layers are independent, so a super_admin or admin seeing another user's file in Wevion does not mean they can open it in the Drive UI. Wevion RBAC controls in-app visibility, while Google Drive permissions control external direct access. To grant Drive access you must create an explicit Drive share (folder-level, writer) to a specific email.
What happens to a departing member's Creative Hub files when I offboard them?
Their files remain in Drive with no data loss, because the Service Account owns everything and ownership cannot be transferred to a user. Before revoking their session, audit their folders via the Members switcher (as super_admin/admin/owner), transfer or archive important files, and review external shares they granted via the shared-emails list so you can revoke stale grants.
Are Creative Hub actions recorded for compliance?
No — Creative Hub actions are not written to the Wevion audit log. There are no creative* audit actions in the code (no creativeview, creativeupload, creativedelete, creativeshare, creativegenerate) and no creativehubfile table. For external access, the shared-emails list shows the current grants; AI generations are recorded as rows in the creative_job table.
What can the finance role do in Creative Hub?
The finance role sees only its own Creative Hub folder — like manager, mediabuyer, and viewer, it has no cross-user visibility. Only super_admin/admin see all users, and owner sees their team. So finance can use its own folder but can't browse others' creatives unless a folder is explicitly shared with it via Drive.
Steps
- Create user (via team-103 invite-member)
- Mediabuyer's ensureUserFolder() triggers on first upload (creates Drive root automatically)
- Optionally: share team brand-assets folder with new user
- Set credit cap if budget control needed
Last updated: 2026-05-17