View-only members could previously obtain a full 24-hour download link for any asset in their organization — including assets in locations they had no access to. That gap is now closed.
Requesting a download link now requires the asset:download permission. The check also verifies that the requesting member has access to the specific location (and project) the asset belongs to — not just the organization as a whole. The two permission levels behave as follows:
Organization admins are unaffected — their org-wide download permission covers all locations and projects beneath it.
No action is needed on your end. Permission assignments you've already made in the Members tab continue to work as intended; this change ensures those assignments are honored consistently when download links are generated.