# Complex Permissions: Cascading Item-level Access through M2A to directus\_comments and Related Files

**URL:** <https://community.directus.com/t/complex-permissions-cascading-item-level-access-through-m2a-to-directus-comments-and-related-files/1094>\
**Category:** Help\
**Tags:** permissions\
**Created:** [September 2, 2025, 11:22am UTC](https://community.directus.com/t/complex-permissions-cascading-item-level-access-through-m2a-to-directus-comments-and-related-files/1094 "2025-09-02T11:22:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahmad\_quvor](https://sea2.discourse-cdn.com/flex002/user_avatar/community.directus.com/ahmad_quvor/32/310_2.png) [@ahmad\_quvor](https://community.directus.com/u/ahmad_quvor)\
**Post date:** [September 2, 2025, 11:22am UTC](https://community.directus.com/t/complex-permissions-cascading-item-level-access-through-m2a-to-directus-comments-and-related-files/1094/1 "2025-09-02T11:22:25Z")

</div>

**Directus Version:** 11.11.0

### **1. Goal**

I am trying to implement a permissions model where access to a comment (from `directus_comments`) is strictly determined by the user’s access to the item the comment is attached to. This must also cascade to files attached to the comment.

The desired logic is:

> `User can read Item X` → `User can read all Comments on Item X` → `User can read all Files on those Comments

`

### **2. Current Setup**

- I have extended the `directus_comments` collection with a Many-to-Any (M2A) relationship field (e.g., `collections`), linking comments to items in various other collections (e.g., `articles`, `pages`, `test`).
- A separate `files` relationship field on `directus_comments` links to the `directus_files` collection.

### **3. The Problem & What I’ve Tried**

The core issue is that permissions for `directus_comments` cannot seem to dynamically reference the permissions of the parent item via the M2A relationship.

I tried to create a read permission rule for the `directus_comments` collection that checks the status of the linked item in the `test` collection:

 ![image](https://us1.discourse-cdn.com/flex002/uploads/directus/original/1X/418e5369528bc82518c8d23372dfbca9e04a5641.png)  
 ![image](https://us1.discourse-cdn.com/flex002/uploads/directus/original/1X/a3fbe298ea4c33bddfa597a43fd44f1243b128bf.png)  
 ![image](https://us1.discourse-cdn.com/flex002/uploads/directus/original/1X/6eb353041875aca569ee524f2f6573d9ef01ccbe.png)  
 ![image](https://us1.discourse-cdn.com/flex002/uploads/directus/original/1X/a30310b20df6998d6d08eff28213ad6329e2f9fb.png)

**Result:** This does not work. Users only see their own comments, not all comments on items they have access to read.

**Assumption:** The permission system cannot perform a deep relational query across an M2A junction to validate the `status` of the parent `test` item.

### **4. Key Details**

- The `test` collection has item-level permissions: users can read an item if `status` is `'published'` OR if they are the `user_created`.
- The junction table for the M2A relationship currently has full read/create permissions.
- The goal is for the comment permissions to be dynamic and inherit the rules of their parent collection/item.

Any guidance, clarification on syntax, or suggested alternative approaches would be immensely helpful. Thank you!