@NoctivagusObitus I'd suggest considering subvolume groups.

@travisn tahnks for your response.
it took me some time reading up an the subvolumes groups. from what I understand they are an abstraction one level above the subvolumes as stated here. what I do not yet understand is if it is enough to use such an hierarchically filesystem based permissioning. my reluctance stems from reading this part of the ceph documentation. as far as I understand the only reliable way of protecting data from unwanted access are some pool level configurations. I may miss understand this... apparently in the end file layouts are relevant to put the data object in proper places inside RADOS. the subvolume groups do manage some of these concepts but from the cli documentation it seams to primarily handle quotas. there is some --uid option but so far I have not seen how this is used and if suits my case.

the point of writing down all of the info I read up on is me asking for some help to better understand these concepts. I have not yet given up on the subvolume groups. could someone give me a hint on how I would properly configure those given I want 2 subvolume groups and have 2 users each being able to exclusively access only one of the subvolume groups? (I do have a local test cluster running by now.)

thanks a lot.