# Restricting the expanded permissions and restoring the original access scope

Restore view-only or assign-only access to specific Studio connections and resources for users who should not have edit permissions.

This procedure applies to users who, before the permission migration, had the Editor (Author) permission but not the Manage permission for a space, and who were granted the Studio connections and Studio resources – Edit user permission after migration.

In the old permission structure, these users can only view or assign the Studio connections and resources in this space with their Editor (Author) permission. After the migration, when they have both the Studio connections and Studio resources – Edit user permission and the Editor (Author) space permission, they inadvertently gain the ability to edit Studio connections and resources.

To restore their original access boundaries, use dedicated spaces and permission assignments to ensure that only authorized users can edit Studio connections and resources, while others retain view-only access, following migration to the new permission model.

## Procedure

1. Create a new space specifically for sharing Studio connections and resources.

   This creation requires the Environment Administrator role.
2. Move the relevant Studio connections and resources into the new space.

   For further information about how to move an object between spaces, see [Moving tasks to another space](https://help.qlik.com/talend/en-US/management-console-user-guide/Cloud/moving-tasks-to-another-workspace "You can move a specific task to another space in the same environment from the Task Details page.").
3. Ensure that the users whose original access scope you need to store have the Studio connections and Studio resources – Edit user permission.

   By default, the Assets Manager role includes this permission. For further information about how to grant a user a specific role, see [Assigning roles](https://help.qlik.com/talend/en-US/management-console-user-guide/Cloud/assigning-roles "Assign roles to specific users using the Role Details page.").
4. Grant the Viewer (View) space permission for this new space to the same users.

   For further information about granting space permissions, see [Assigning permissions to users for a single space](https://help.qlik.com/talend/en-US/management-console-user-guide/Cloud/setting-workspace-permissions-for-users "Assign space permissions to users, for example to manage or view objects in a space.") and [Assigning permissions to users for multiple spaces](https://help.qlik.com/talend/en-US/management-console-user-guide/Cloud/setting-user-permissions-for-workspaces "Assign the space permissions to users, for example to manage or view objects in multiple spaces.").

## Results

The original access boundaries to Studio connections and resources are now restored.

Combine the procedure in this section with those in [Restoring the edit access](https://help.qlik.com/talend/en-US/management-console-user-guide/Cloud/restore-user-edit-ability "Create dedicated spaces to share Studio connections and resources with only designated users.") to achieve granular access control to these objects.