Home / Free / Five roles, restricted folders, and a name that stays on the file
Access
Five roles, restricted folders, and a name that stays on the file
A team is not one shared password. Each person has a role, and a folder can be restricted so only the people you grant can see it. Owners and admins always see the team drive.
When someone leaves, their uploads stay with the team. The file still says who added it, who last changed it, and who shared a recording. A removed person is shown with their name and the month they left.

What each role can do
The owner can do everything an admin can, plus billing, transferring ownership, and closing the team. Transfer picks an admin, and the billing contact moves with it. You cannot delete your account while you still own a team that has other members. Transfer ownership or close the team first.
- Admin: members, settings, verified domains, restricted folders, any file, Trash, the activity log, and devices that sync into this team
- Member: unrestricted files and folders, plus adding files, recording into the team, and changing or deleting their own
- Contributor: upload and record into the team, and see only their own uploads plus folders granted to them. This is the field-staff role
- Viewer: read and download only
Restricted folders
A restricted folder uses the nearest restricted parent to decide access. People who are not granted it do not see it in the list, in search, in previews, or in the change feed that Finder and the Files app follow. A grant is view or edit.
When a grant is removed, those apps receive a delete for the files the person can no longer see, so the copies drop out of Finder and Files. Owners and admins are not blocked by a restricted folder.
Attribution and the activity log
The person who added a file stays the uploader. Renames, moves, and newer saves record who changed it. A recording records who shared it, and which device. Admins get an activity view filtered by person, action, and date.
Admins see devices that sync photos into this team, not phones that only sync to My Files or to a different team. They also see how much of this team’s storage each member uses.
Questions
- Can a contributor browse the whole team drive?
- No. A contributor sees their own uploads and any folder an admin has granted them. Members see unrestricted content. Owners and admins see the whole team drive, including restricted folders.
- Do we get SSO or a HIPAA plan with these roles?
- No. Roles, restricted folders, and a verified company domain are not single sign-on, SCIM, or a HIPAA offering. A verified domain can offer Join to people already signed in with that domain. They still have to accept, and public mail hosts cannot be verified.
- What do admins see about phones?
- Devices syncing into that team: the device name, model, app version, and sync status. Phones syncing only to someone’s personal library, or to another team, are not in that list.
- Is there version history?
- You open the current file. If two saves race, the loser is kept beside it as a conflicted copy. There is no version-history browser. The file does show who added it and who last changed it. Trash keeps deletes for 30 days.
Related features
Comparisons
Record and edit free. Upgrade when you need more links.
FrameCast recording, captions, cleanup, and export stay free. Pro is $5.00/month billed yearly for unlimited share links and viewer insights.