Files Access Control and Workflow — rules for file actions

With the Files Access Control and Workflow apps you can define automatic rules that react to specific file operations — e.g. block sharing of external files, assign tags automatically, kick off file conversions. Very useful for larger setups with compliance requirements; in a private context, mostly a toy.

Prerequisites

Enable in Administration settings → Apps:

• Files Access Control — prevents actions
• Workflow Engine — triggers actions
• (Optional) Workflow: Convert files — automatic conversions

Both apps then show up under Administration settings → Workflow.

Files Access Control — rules that block actions

The classic use case: forbid certain file actions under defined conditions.

Example rules

Block sharing of confidential documents:

Condition	Action
Tag = “Confidential” AND shared with an external user	Deny action

→ Files with the “Confidential” tag can’t be shared externally at all. The user sees an “action blocked” notice.

Limit upload size for a specific group:

Condition	Action
Group = “Interns” AND file > 100 MB	Deny upload

Sharing only with specific groups:

Condition	Action
Shared outside the “Employees” group	Deny action

Configuration language

The condition input reads as “if these conditions are met, then block”. Conditions can be combined (AND/OR):

• File size (>, <, =)
• File MIME type (e.g. only PDFs)
• User group
• Tag
• Path (e.g. only in the /Vertraulich folder)
• Time (time of day, weekday)
• Sharing type (user, group, public)
• Recipient of the share

Limits

Files Access Control is not DRM. It prevents the sharing function in Nextcloud, but:

• A user can download the file and send it manually
• A user with edit rights can copy the content

Realistically: good against accidental wrong actions, not very effective against actively malicious users.

Workflow Engine — automatic triggers

Automatically do something on file events (upload, change, sharing).

Example triggers

Auto-tag on upload into a specific folder:

Trigger	Action
File upload into /Eingehende-Rechnungen	Assign the tag “Invoice” automatically

Auto-notification on external sharing:

Trigger	Action
Share with an external user	Send mail to the admin

Auto-conversion:

Trigger	Action
Upload of .docx into /Archiv	Auto-convert to PDF

(The last one needs the Workflow Convert app.)

Available trigger actions

• Set / remove a tag
• Move a file
• Send a mail notification
• Fire a webhook (to an external system)
• Auto-convert to PDF

On xaweho setups the standard actions are active. Custom actions via webhook we can set up on request — a ticket is enough.

Practical use cases

Club setup

• Tag “Member data” → no public sharing allowed
• Auto-tag “Minutes” for all files in /Vorstand/Protokolle
• Mail notification to the board on external sharing

Company setup

• File uploads >500 MB only for the “Admin” group
• Tag “HR data” → shareable internally only
• Auto-conversion of office files to PDF in the /Archiv folder

Practice (doctor / lawyer / tax advisor)

• Tag “Client data” → public sharing blocked
• Audit webhook on every sharing operation for compliance logs

Family / private

Usually overkill. Possibly:

• Auto-tag “Photo” for everything in /Photos (for searching later)

Tag management

Tags are the basis of many rules. Managed here:

• Administration settings → Collaborative tags
• Defining tag types:
  • Visible: all users can see and assign the tag
  • Restricted: only specific groups can assign it
  • Invisible: admins only, assigned system-internally

For Files Access Control rules you’ll often use restricted/invisible tags.

Assigning tags

A user can assign tags manually: a file’s ⓘ sidebar → tags section → pick an existing tag or create a new one.

Auto-tagging via the Workflow Engine saves the manual work.

Pitfalls

Rule order

When several rules match, order matters. The first matching rule wins. In the workflow UI you can prioritize rules via drag and drop.

Performance

With many rules and large setups (10,000+ files), workflow evaluation can generate load. We keep an eye on server performance — if anything stands out, we get in touch.

External sharing ban — workaround?

A user with blocked external sharing can get around it by using another user’s public-sharing right (another user in the cloud who re-shares). So: for a real sharing restriction, you have to restrict the sharing permission globally per group (in the sharing settings as admin).

User confusion

When a user unexpectedly sees “action blocked”, they wonder what’s going on. So: document the rules clearly, maybe create an internal FAQ.

Frequently asked questions

Can I configure workflows differently per user? Workflow rules are global or group-based. Not directly per user — but you can simulate it through group membership.

Audit logs — are actions logged? Workflow actions are visible in the Activity app. For deeper audit logs (with server-side persistence, external SIEM integration) you need additional apps like Activity Audit.

Performance impact of many rules? Under 50 rules: barely measurable. Over 200 rules: noticeable. Recommendation: write rules efficiently, frequently matched conditions first.

Auto-conversion — what’s the trade-off? Conversion creates a second file (the original stays). Storage doubles. With large volumes: watch the storage impact.

Webhooks — on which triggers? On all of them that are defined as triggers in the workflow setup. The webhook URL is your own API; Nextcloud sends a JSON POST with the file metadata.

Can users see the workflow rules? Users only see rules that reference tags visible to them. Admin rules with invisible tags are not detectable by users.

What happens when a file is moved — do tags move with it? Yes. Tags attach to the file, not the path.

Is the Workflow Engine open source? Yes. All workflow apps are open source.

What’s next

• Internal and external sharing
• Admin GUI overview
• Users and groups