How to limit team members to specific client folders

Most agencies start with good intentions about file organisation. There is a folder for each client, a rough naming convention, and an understanding that people should stay in their lane. Then the team grows. A new designer joins and suddenly has access to every client's brand assets, billing notes, and strategy documents. A freelance copywriter brought on for one project can browse folders belonging to clients they have never met. The mess is not malicious. It is structural. When your platform does not let you draw clear boundaries around who sees what, everyone ends up seeing everything.

This is not just untidy. It is a liability. Clients trust you with competitive information, financial details, and internal communications. If a team member working on Client A can casually open Client B's folder, you have a confidentiality problem whether or not anyone looks. The risk compounds with contractors, freelancers, and offshore teams who rotate through projects on short engagements.

Fabric gives you the tools to prevent this at the platform level. Rather than relying on trust or policy documents, you can configure granular permissions so that each person on your team only has access to the client folders they need. This guide explains how to set that up and why it matters more than most agencies realise.

How Fabric's permission model works

Fabric's approach to access control operates at two levels: spaces and individual items. A space is a container that can hold folders, files, notes, bookmarks, and other resources. Within a space, every item can carry its own permission settings, and those permissions cascade down through subfolders unless you override them.

There are four roles available: viewer, commenter, editor, and admin. A viewer can see content but not change it. A commenter can add remarks without altering the underlying material. An editor can create, modify, and reorganise files. An admin can do all of that plus manage who else has access. These roles can be assigned at the space level, at the folder level, or on individual files. This means you can invite someone into a space as a viewer but grant them editor access to one specific folder within it, or the reverse.

The important thing is that permissions are not just suggestions. Fabric enforces them across every surface, including the AI assistant. If a team member does not have access to a client's folder, they cannot search its contents, ask the AI questions about it, or stumble across it in recommendations. The boundary is real, not cosmetic.

Setting up client folders with scoped access

The simplest pattern for agencies is one folder per client inside a shared team space. Start by creating a space for your organisation if you have not already. Within that space, create a top-level folder for each client. Then, instead of giving every team member access to the entire space, invite them only to the specific client folders they work on.

Here is how that looks in practice. Say you run a marketing agency with three clients: a fintech startup, a hospitality brand, and a healthcare company. You have a strategist who works across all three, a designer who handles the fintech and hospitality accounts, and a copywriter who only works on the healthcare account. You would give the strategist access to all three client folders, the designer access to two, and the copywriter access to one. Each person logs in and sees only their relevant work. There is no clutter from projects they are not involved in and no risk of them accessing confidential material from other accounts.

This is where Fabric's folder-based organisation becomes particularly useful. Within each client folder, you can nest subfolders for deliverables, briefs, assets, and correspondence. The permissions you set at the client folder level flow down to everything inside it, so you do not need to configure access on every single file.

Using spaces to separate concerns

For larger agencies, a single space with client folders may not be enough. You might want separate spaces for different departments, service lines, or office locations. Fabric supports this. You can create a space for your design team, another for your content team, and another for account management. Within each, the relevant client folders live with their own permission settings.

Spaces also let you manage access at a higher level. If your entire design team should see the same set of client folders, you can manage that at the space level rather than configuring each folder individually. When someone joins the design team, you add them to the design space and they inherit the appropriate access. When they leave, you remove them and their access disappears.

This layered approach, spaces for teams and folders for clients, gives you a structure that scales without becoming unwieldy. You can read more about how agencies organise their work in Fabric in the guide on how to organise client files.

Why the AI assistant respects boundaries

One of the less obvious benefits of Fabric's permission model is that it extends to the AI assistant. When a team member asks the AI to find a document, summarise a brief, or draft a response based on stored materials, the AI only draws on content that person is authorised to access. It will not surface information from a client folder they cannot see, even if that information would be relevant to their query.

This matters because AI assistants that can search across an entire organisation's knowledge base are powerful but dangerous if access controls do not apply. Imagine a freelancer asking the AI to "find all strategy documents from the last quarter." Without permission-aware search, they might receive results from every client in your portfolio. With Fabric, they only see results from the clients they are assigned to.

The same principle applies to Fabric's search and self-writing documents. Every feature that reads from your stored knowledge respects the same access boundaries. This is part of what makes Fabric viable as a secure knowledge base for client work.

Handling contractors and temporary access

Agencies often bring in freelancers or contractors for short engagements. These people need access to specific client materials for a defined period, and then that access should end. Fabric handles this through the same permission model. You invite the contractor to the relevant client folder with the appropriate role, and when the project is finished, you remove their access.

For situations where external agents or automated tools need access to your Fabric content, agent access can be scoped and time-limited. This means you can grant a tool or integration access to a specific set of resources without opening up your entire library. The access expires when it is no longer needed, reducing the window of exposure.

Activity history adds another layer of oversight. Fabric records who accessed what and when, so you have a clear audit trail if questions arise about who viewed or modified a particular file. For agencies working with clients in regulated industries, this kind of traceability is not optional.

Keeping track of work with Kanban views and tags

Restricting access is one half of the equation. The other half is making sure people can find and manage the work within their permitted folders without friction. Fabric's Kanban views let you turn any client folder into a visual project board, so team members can track deliverables, review stages, and deadlines without needing a separate project management tool.

Tags offer another way to slice through your work. While permissions control who sees what, tags let you categorise content across clients. A team member might tag all brand guidelines, regardless of client, to quickly pull them up when working on a new project. Tags work within the boundaries of that person's access, so they will only see tagged items from folders they can reach.

Security beyond permissions

Permissions are the most visible layer of security, but they sit on top of Fabric's broader security infrastructure. All data is encrypted with AES-256, and Fabric holds CASA Tier 2 certification. Your cloud storage is not subject to the same capacity constraints as traditional file-sharing tools, so you do not need to archive or delete client materials to stay within limits. Everything stays accessible to the people who should see it, and invisible to those who should not.

For a deeper look at how Fabric handles security and privacy, the private and secure page covers the technical details.

A practical example: onboarding a new team member

Suppose you hire a junior account manager who will handle two of your five clients. Here is what the setup looks like. You add them to your organisation's space. You navigate to the two client folders they will work on and invite them with the editor role, since they need to add meeting notes, upload assets, and update briefs. The other three client folders remain invisible to them. When they log in, they see a clean workspace with just the two clients. The AI assistant, search, and document tools all operate within those boundaries. If they are later assigned a third client, you add them to that folder. If they are removed from an account, you revoke access to that folder. The whole process takes less than a minute.

This is the kind of setup that agencies managing multiple clients describe in more detail on the agency owners page and in the guide on managing multiple clients.

Frequently asked questions

Can I give a team member different roles in different client folders?

Yes. Fabric's permissions are set per item, so a team member can be an editor in one client folder and a viewer in another. This is useful when someone needs to contribute to one account but only needs read access to reference materials in another.

Will the AI assistant show content from folders a team member cannot access?

No. The AI assistant, search, and all features that draw on stored content respect the same permission boundaries. A team member will only see results from folders and files they have been granted access to.

Can I set up access so that a team member sees a folder but cannot edit anything in it?

Yes. Assign them the viewer role on that folder. They will be able to open and read files but will not be able to create, modify, or delete anything inside it.

How do I remove access when a contractor finishes a project?

Go to the client folder, open its sharing settings, and remove the contractor's access. Their permissions are revoked immediately, and any AI or search features will stop including that folder's content in their results.

Is there an audit trail showing who accessed client files?

Fabric records activity history, so you can see who viewed, edited, or added files and when. This is useful for compliance, client reporting, and resolving questions about changes to shared documents.

Can I restrict access at the file level, not just the folder level?

Yes. While folder-level permissions are the most practical for client-based organisation, you can also set permissions on individual files. This is helpful for sensitive documents like contracts or financial summaries that only certain people should see, even within a client team.

Does Fabric support separate workspaces for different departments?

Yes. You can create multiple spaces within your organisation, one for each department, team, or service line. Each space has its own membership and permission settings, and client folders within each space can be further scoped to specific team members.

What happens if I move a file from one client folder to another?

The file inherits the permissions of its new location. If a team member does not have access to the destination folder, they will lose access to that file. This keeps permissions consistent and prevents accidental exposure when files are reorganised.

Can clients themselves be given access to their folder?

Yes. You can invite clients as viewers or commenters on their own folder, giving them a client portal experience without exposing any other part of your workspace. The guide on giving a client access to only their files covers this in detail.

How does this work with Fabric's memory and context features?

Fabric's memory engine builds context from the content each user can access. A team member's memory and contextual suggestions are shaped by their permitted folders, so the system becomes more helpful over time without crossing access boundaries. The AI learns from what each person works with, not from the entire organisation's library.

Related pages

• How to give a client access to only their files

• How to organise client files

• How to set up a client portal

• Managing multiple clients

• Fabric for agency owners

• Fabric for agencies