Subuser permissions use area keys (files, console, backups, ...), so require "files" (or the legacy "file"/"file.*" forms) for file proxy access instead of only the granular forms.