Permissions and access

Start from what you are seeing rather than from what you think is broken. Each page below names the symptom, explains why it happens, and says what to do about it.

Several of these are the product working as designed, which is worth knowing before anybody raises a ticket.

#At a glance

Symptom	Usually because
Image shows 'You do not have permission to view this image'	The viewer cannot read the space that holds the library image.
Upload button is greyed out, or the library says 'You don't have permission to upload images to this	Uploading needs two separate Confluence permissions in that space: create-attachment AND create-page-or-blogpost. Having attachment rights alone is not enough. Folder create, rename and dele
Cannot change who edits global images from inside Capable	The REST endpoints refuse them. The Asset access tab is read-only by necessity.
Changing the permissions on Asset access also changed diagrams, markdown, calendar or search	All Capable global assets share one Confluence custom-content type in one space. There is no images-only permission.
Cannot find the Capabilities, Indexing, Egress or Migration settings tab in the standalone Images ap	None of these ship in standalone. Capabilities (the instance-wide hide switch) is added only in the Suite; Indexing is hidden because the standalone app carries an indexing-disabled flag; Eg
Cannot turn Images off for a single space	The Space settings screen only shows the Auto/Always/Never control for capabilities that can be pinned to the nav bar, and Images cannot be pinned. Its row shows a read-only 'Available from
'No permission to add images to this page' at the bottom of the insert dialog	You can read the library but you cannot edit this page.
Image cannot be edited before inserting	Images over 3 MB cannot be opened in the image editor. The same 3 MB ceiling applies when loading a page attachment for editing or importing.
Rovo agent / external MCP client cannot use the Capable image tools	Neither app publishes the image verbs to other people's agents. The standalone app deliberately declares no MCP module at all, and the Suite's MCP module publishes only the two approval tool

#In this section

Image shows 'You do not have permission to view this image'An image shows 'You do not have permission to view this image'Upload button is greyed out, or the library says 'You don't have permission to upload images to thisThe Upload button is greyed out, or the library says 'You don't have permission to upload images to this space' / 'to the global library'Cannot change who edits global images from inside CapableI cannot change who edits global images from inside Capable Changing the permissions on Asset access also changed diagrams, markdown, calendar or searchChanging the permissions on Asset access also changed diagrams, markdown, calendar or search Cannot find the Capabilities, Indexing, Egress or Migration settings tab in the standalone Images apI cannot find the Capabilities, Indexing, Egress or Migration settings tab in the standalone Images app Cannot turn Images off for a single spaceI cannot turn Images off for a single space 'No permission to add images to this page' at the bottom of the insert dialog'No permission to add images to this page' at the bottom of the insert dialog Image cannot be edited before insertingAn image cannot be edited before inserting Rovo agent / external MCP client cannot use the Capable image toolsMy Rovo agent / external MCP client cannot use the Capable image tools

Troubleshooting

Every symptom.

Reference

Limits and gaps.

How it works

The behaviour.

Most of these are expected behaviour.