How to Use and Set Up Access Rights

Summary

Bynder offers four access layers to control who can view and manage your assets: permission profiles, groups, advanced rights, and metaproperty option access rights.

Together, these layers keep your asset bank open by default while protecting sensitive, licensed, or unreleased content. This article explains how they work and links to setup instructions for each layer.

Who?

A Bynder Admin configures access rights. Each task needs a specific permission:

• Permission profiles: Manage permission profiles.
• Groups: Manage users.
• Metaproperty access rights: Manage metaproperties and Manage metaproperty options.

Other users with the right permissions can still perform day-to-day actions within these limits, such as selecting metaproperty options or advanced rights when uploading assets.

Why?

Access rights protect assets and keep your asset bank organized, but over-restricting access can frustrate users and get in the way of content reuse. Bynder recommends starting from an open asset bank and adding restrictions only when you have a specific business reason, such as legal separation between brands, embargoed campaign content, or licensed stock photography.

How?

The four layers of access control

1. Permission profiles: what  users can do: Every user belongs to one permission profile, which determines system-wide capabilities like uploading, editing, deleting, or downloading. Bynder groups these into light, regular, and heavy user tiers. Some permissions, such as the ability to upload directly, will automatically move a user to a higher tier. See How To Create And Manage Permission Profiles and Understanding Permissions In Your Asset Bank.

2. Groups how users are organized:  Groups let you organize users by brand, region, department, or any other grouping that matters to your organization. Groups do not restrict access on their own. They become useful once you reference them in advanced rights or metaproperty option access rights.

See Create and Manage Groups in Group Management in Users & Rights.

3. Advanced rights who can see or download a specific asset

 Advanced rights are set on individual assets (at upload or edit) and cover four scenarios:

• Public: Generates a shareable URL, for example to use an asset on your website. This can't be undone once applied.
• Limited usage: Hides an asset from everyone except specific permission profiles, groups, or users, typically until a release date.
• Archive: Hides an asset after it expires, while keeping it in the asset bank  for users who still need it.
• Watermark: Lets users view an asset, but requires approval before they can download the file without the watermark. 

Warning: You cannot undo Public after you apply it.

You can also apply advanced rights  automatically based on metadata, for example, watermarking everything tagged as "Stock." See What are Advanced Rights, How To Mark Assets As Archived, Understanding And Enabling Public Assets, and Use Automations to Set Advanced Rights.

4. Metaproperty access rights: who can see assets based on their tags:

This is the most granular layer and the one customers ask about most. Use it to separate content by brand, region, or department. 

It has two parts:

• Metaproperty visibility hides the metaproperty field itself (not the assets) from specific users, groups, or permission profiles on the upload and edit screens.
• Metaproperty option access rights control who can see, edit, upload, or delete assets tagged with a specific option of a metaproperty, for example  all assets tagged "Region: EMEA".

Manage option-level access through a single metaproperty, such as "Visibility" or "Access," to keep configuration simple. Make sure option-level rights match what the user's permission profile already allows. See Manage Metaproperty Visibility for hiding fields, and How To Configure Access Rights For Metaproperty Options for the full option-level setup steps

🛑 CRITICAL WARNING: Hide by Default - Total Portal Lockout

Enabling "Hide by default" on a metaproperty option without configuring at least one "Show media" access right results in a silent, total lockout. Always assign at least one "Show media" exception, including at least one admin profile for troubleshooting purposes.

Which access control tool should I use?

Updated November 02, 2026 10:38