Permissions

Two permissions, under an Archive heading in Settings → Users → User Groups. Creating a bundle and being allowed to walk away with one are separate decisions.

PermissionHandleGrants
Create export bundles archive:export Access to the Export screen and the ability to run an export.
Download and delete bundles archive:manage Downloading a finished bundle’s ZIP, and deleting bundles.

What each screen needs

  • Export — appears in the sidebar only with archive:export.
  • Bundles — visible to anyone who can reach the Archive section; downloading and deleting from it need archive:manage.
  • Settings — admins only, like any plugin’s settings.

Admins have both permissions implicitly, as always in Craft.

Why they’re split

A bundle is the whole site in one downloadable file. Running an export is an operational act; taking a copy of everything home is a different one. Splitting them lets a developer trigger exports on a client’s site — to check the content model is exporting cleanly, say — without holding the key to the content itself.

It matters more once user export is enabled, at which point archive:manage is effectively “may download the user list”. Grant it deliberately.

The console has no permissions

Console commands run as the system, so anyone with shell access can export anything regardless of these settings. That’s normal for Craft — shell access is already total access — but worth remembering when you’re reasoning about who can obtain a bundle.