diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 3b9dfae61f..1c1af96d05 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -17506,7 +17506,7 @@ components:
           type: string
         public_resource:
           type: boolean
-        allow_user_paths:
+        restrict_to_user_paths:
           type: boolean
         secondary_storage:
           type: object
@@ -17531,7 +17531,7 @@ components:
                 type: string
               public_resource:
                 type: boolean
-              allow_user_paths:
+              restrict_to_user_paths:
                 type: boolean
 
     DucklakeSettings:
diff --git a/backend/windmill-common/src/s3_helpers.rs b/backend/windmill-common/src/s3_helpers.rs
index bf7f94e5a5..182fc1cf2f 100644
--- a/backend/windmill-common/src/s3_helpers.rs
+++ b/backend/windmill-common/src/s3_helpers.rs
@@ -237,13 +237,13 @@ impl LargeFileStorage {
             LargeFileStorage::GoogleCloudStorage(gcs_lfs) => &gcs_lfs.gcs_resource_path,
         }
     }
-    pub fn allow_user_paths(&self) -> bool {
+    pub fn restrict_to_user_paths(&self) -> bool {
         match self {
-            LargeFileStorage::S3Storage(lfs) => lfs.allow_user_paths,
-            LargeFileStorage::S3AwsOidc(lfs) => lfs.allow_user_paths,
-            LargeFileStorage::AzureBlobStorage(lfs) => lfs.allow_user_paths,
-            LargeFileStorage::AzureWorkloadIdentity(lfs) => lfs.allow_user_paths,
-            LargeFileStorage::GoogleCloudStorage(glfs) => glfs.allow_user_paths,
+            LargeFileStorage::S3Storage(lfs) => lfs.restrict_to_user_paths,
+            LargeFileStorage::S3AwsOidc(lfs) => lfs.restrict_to_user_paths,
+            LargeFileStorage::AzureBlobStorage(lfs) => lfs.restrict_to_user_paths,
+            LargeFileStorage::AzureWorkloadIdentity(lfs) => lfs.restrict_to_user_paths,
+            LargeFileStorage::GoogleCloudStorage(glfs) => glfs.restrict_to_user_paths,
         }
         .unwrap_or(false)
     }
@@ -265,7 +265,7 @@ pub struct S3Storage {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub public_resource: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_user_paths: Option<bool>,
+    pub restrict_to_user_paths: Option<bool>,
 }
 
 #[derive(Serialize, Deserialize, Debug)]
@@ -274,7 +274,7 @@ pub struct AzureBlobStorage {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub public_resource: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_user_paths: Option<bool>,
+    pub restrict_to_user_paths: Option<bool>,
 }
 
 #[derive(Serialize, Deserialize, Debug)]
@@ -283,7 +283,7 @@ pub struct GoogleCloudStorage {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub public_resource: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_user_paths: Option<bool>,
+    pub restrict_to_user_paths: Option<bool>,
 }
 
 #[derive(Clone, Debug)]
@@ -1136,12 +1136,12 @@ pub fn check_lfs_object_path_permissions(
     }
     let username = authed.username.as_str();
 
-    if lfs.allow_user_paths() {
-        if object_path.starts_with(&format!("u/{username}/")) {
-            return Ok(());
+    if lfs.restrict_to_user_paths() {
+        if !object_path.starts_with(&format!("u/{username}/")) {
+            return Err(error::Error::NotAuthorized(format!(
+                "Can only access paths u/{username}/**"
+            )));
         }
     }
-    return Err(error::Error::NotAuthorized(format!(
-        "Cannot access path {object_path}"
-    )));
+    return Ok(());
 }
diff --git a/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte b/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
index 23abba3fca..70ed43b830 100644
--- a/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
@@ -222,9 +222,9 @@
 		<svelte:fragment slot="content">
 			<div class="flex flex-col gap-3 mx-4 py-4 w-[40rem]">
 				<Toggle
-					bind:checked={storage.allowUserPaths}
+					bind:checked={storage.restrictToUserPaths}
 					options={{
-						right: 'Allow access to u/username/** paths',
+						right: 'Restrict access to u/username/** paths',
 						rightTooltip:
 							'If set, all users will be able to read and write objects with path u/username/**'
 					}}
diff --git a/frontend/src/lib/workspace_settings.ts b/frontend/src/lib/workspace_settings.ts
index 6051aee3cd..05ce8fa506 100644
--- a/frontend/src/lib/workspace_settings.ts
+++ b/frontend/src/lib/workspace_settings.ts
@@ -8,7 +8,7 @@ type s3ResourceSettingsItem = {
 	resourceType: s3type
 	resourcePath: string | undefined
 	publicResource: boolean | undefined
-	allowUserPaths?: boolean
+	restrictToUserPaths?: boolean
 }
 export type S3ResourceSettings = s3ResourceSettingsItem & {
 	secondaryStorage: [string, s3ResourceSettingsItem][] | undefined
@@ -33,42 +33,42 @@ export function convertBackendSettingsToFrontendSettingsItem(
 			resourceType: 's3',
 			resourcePath: large_file_storage?.s3_resource_path?.replace('$res:', ''),
 			publicResource: large_file_storage?.public_resource,
-			allowUserPaths: large_file_storage?.allow_user_paths
+			restrictToUserPaths: large_file_storage?.restrict_to_user_paths
 		}
 	} else if (large_file_storage?.type === 'AzureBlobStorage') {
 		return {
 			resourceType: 'azure_blob',
 			resourcePath: large_file_storage?.azure_blob_resource_path?.replace('$res:', ''),
 			publicResource: large_file_storage?.public_resource,
-			allowUserPaths: large_file_storage?.allow_user_paths
+			restrictToUserPaths: large_file_storage?.restrict_to_user_paths
 		}
 	} else if (large_file_storage?.type === 'AzureWorkloadIdentity') {
 		return {
 			resourceType: 'azure_workload_identity',
 			resourcePath: large_file_storage?.azure_blob_resource_path?.replace('$res:', ''),
 			publicResource: large_file_storage?.public_resource,
-			allowUserPaths: large_file_storage?.allow_user_paths
+			restrictToUserPaths: large_file_storage?.restrict_to_user_paths
 		}
 	} else if (large_file_storage?.type === 'S3AwsOidc') {
 		return {
 			resourceType: 's3_aws_oidc',
 			resourcePath: large_file_storage?.s3_resource_path?.replace('$res:', ''),
 			publicResource: large_file_storage?.public_resource,
-			allowUserPaths: large_file_storage?.allow_user_paths
+			restrictToUserPaths: large_file_storage?.restrict_to_user_paths
 		}
 	} else if (large_file_storage?.type === 'GoogleCloudStorage') {
 		return {
 			resourceType: 'gcloud_storage',
 			resourcePath: large_file_storage?.gcs_resource_path?.replace('$res:', ''),
 			publicResource: large_file_storage?.public_resource,
-			allowUserPaths: large_file_storage?.allow_user_paths
+			restrictToUserPaths: large_file_storage?.restrict_to_user_paths
 		}
 	} else {
 		return {
 			resourceType: 's3',
 			resourcePath: undefined,
 			publicResource: undefined,
-			allowUserPaths: undefined
+			restrictToUserPaths: undefined
 		}
 	}
 }
@@ -93,7 +93,7 @@ export function convertFrontendToBackendettingsItem(
 		let resourcePathWithPrefix = `$res:${s3ResourceSettings.resourcePath}`
 		let params = {
 			public_resource: s3ResourceSettings.publicResource,
-			allow_user_paths: s3ResourceSettings.allowUserPaths
+			restrict_to_user_paths: s3ResourceSettings.restrictToUserPaths
 		}
 		if (s3ResourceSettings.resourceType === 'azure_blob') {
 			let typ: LargeFileStorage['type'] = 'AzureBlobStorage'