Managing assets in a TYPO3 9.5 multisite setup - typo3

Question

What is the best way to separate assets in a multi site TYPO3 9.5 setup. So editors of site A do not have access to the assets of site B and vice versa. But editors with permissions to edit both sites, should have access to the assets of site A and B.

Answer 1

In general: try to avoid assigning anything to users directly.
Try to assign rights, acccess to BE usergroups. so you have roles which can be granted to individuals. and if someone has multiple roles he gets multiple usergroups and has the compound rights.
Be aware of some drawbacks you will not be able to avoid:
if a user has access to multiple filemounts (because of different roles) he can use these cross over.
In your case: if an user has access to filemount A for site A and filemount B for site B he also can use a file from A in the pages of B. Other editors with only access to site B may have problems to edit this.
Creating new pages might hide the new pages for other users. as TYPO3 uses a similar system of rights like the unix file system you must ensure that new pages have the correct group so other members of the group can access these pages. as normaly the first group is taken it might be the group of the other site. give all pages a default group with TSconfig in the root pages of the different sites.
.
TCEMAIN.permissions {
# the id if the BE usergroup who should be able to edit pages in this tree
groupid = 13
# now the rights for owner, group, world (1)
user = 31
group = 19
everybody = 1
}
(1) the rights are assigned bitwise:
2^0 = 1 = show page (show/Copy page and content)
2^1 = 2 = edit page (Change/Move page, eg. change page title)
2^2 = 4 = delete page (delete page or content)
2^3 = 8 = new pages (create new pages under this page)
2^4 = 16 = edit content (change/ add/ delete/ move content)