The first network they sign in from becomes the only one
they can sign in from. Make sure their first sign-in happens from where
they normally work.
People
Pick someone to change what they can open.
Files
Tap a file to cycle it: no access → read → read and write
→ no access. DEL lets them remove that file.
NEW on a folder lets them add files to it — that one cannot be
per-file, because the file does not exist yet.
Folders
One grant on folder/* — the files directly
in it, not its subfolders. Use the pattern box below for a whole
subtree. READ on its own gives the folder read-only; switching
it off revokes the folder entirely, since there is no editing a file
you cannot open.
Files
By pattern
For anything the buttons cannot say — a whole subtree
(src/**/*), or one file type across it
(src/**/*.cpp). Nothing ticked is a read-only grant.
Applying tells you how many files it matched, which is the only way to
catch a pattern wider than you meant.