Today, a Collection in CMP has no access list of its own and does not inherit or enforce the permissions of the assets or folders it references. Once an asset is added to a collection, it becomes visible to every internal user with Library access across the organisation, regardless of the asset's own sharing settings (private, team-restricted, etc.). There is currently no admin setting or custom role permission that restricts a collection to a defined set of users or teams, and no privacy/draft state on the collection itself.

The only lever that exists (password, expiration, renditions) governs the external public link, not internal visibility so there is no way to create an internally restricted collection at all. This is needed for anyone who needs who need to build co-branded campaign assets that only a defined partner group should see; because folders cannot be shared by link, Collections are currently their only mechanism for sending a curated asset set externally, but doing so simultaneously exposes those same restricted assets to the entire internal organisation.

This could be achieved by adding either an accessor list on Collections mirroring the folder/asset model (organisation, team, user, view access), so a collection can be scoped to only the people who should see it internally, or (b) an option for a collection to inherit and enforce the permissions of its constituent assets/folders, so users without access to an asset in the Library also cannot see it via a collection. Either approach would let clients use Collections for controlled internal and external distribution of sensitive or partner-restricted content without exposing it instance-wide.