Collection Visibility and Search Scope Across Teams
A media company has 500,000 assets. The newsroom uses Collections heavily; marketing uses saved searches. Editors complain that a shared collection named "Election 2024" shows assets they cannot open (permission denied), and that saved searches return assets from folders they should not see. The instance uses AEM Assets with ACLs applied at folder level and Collections created by multiple users. Some collections are private, some shared. Search is the default Assets search.
1. Why can a user see an asset in a shared collection but get permission denied when opening it, and how do collections interact with ACLs?
Read the worked answer
Collections are references (links) to assets, not copies. A shared collection can include an asset that lives in a folder the viewer has no read ACL on. The collection lists the reference, but opening the asset resolves to its actual path, where ACLs apply. So visibility in a collection does not grant read access.
This is expected AEM behavior: collections do not override asset ACLs. The symptom (visible in collection, denied on open) is the signature of a reference to an inaccessible asset.
Confirm by checking the asset's actual path and the user's effective permissions there, versus the collection's sharing settings.
2. Saved searches return assets from folders a user should not see. What is happening and how do you fix it?
Read the worked answer
Saved searches store query parameters, not a permission snapshot. When executed, the query runs against the index; results are then filtered by the user's ACLs. If a user sees assets from restricted folders, likely causes:
- ACLs not applied where assumed (e.g., applied to a parent but a child folder lacks deny, or inheritance broken).
- Index/ACL lag after permission changes; reindex or wait for propagation.
- Saved search authored by an admin and shared, with the expectation it filters per-user - verify results are evaluated with the viewer's permissions, not the author's.
Fix: audit effective permissions on the flagged paths, correct ACLs (deny or remove read), and re-verify the saved search as the affected user. Do not "fix" by hiding the saved search; fix the ACLs so search filtering is correct for everyone.