diff --git a/src/applications/conpherence/__tests__/ConpherenceRoomTestCase.php b/src/applications/conpherence/__tests__/ConpherenceRoomTestCase.php
--- a/src/applications/conpherence/__tests__/ConpherenceRoomTestCase.php
+++ b/src/applications/conpherence/__tests__/ConpherenceRoomTestCase.php
@@ -126,6 +126,29 @@
     }
   }
 
+  public function testAddMessageWithFileAttachments() {
+    $creator = $this->generateNewTestUser();
+    $friend_1 = $this->generateNewTestUser();
+    $join_via_add = $this->generateNewTestUser();
+
+    $participant_map = array(
+      $creator->getPHID() => $creator,
+      $friend_1->getPHID() => $friend_1,
+    );
+
+    $conpherence = $this->createRoom(
+      $creator,
+      array_keys($participant_map));
+
+    foreach ($participant_map as $phid => $user) {
+      $xactions = $this->addMessageWithFile($user, $conpherence);
+      $this->assertEqual(2, count($xactions));
+    }
+
+    $xactions = $this->addMessageWithFile($join_via_add, $conpherence);
+    $this->assertEqual(2, count($xactions));
+  }
+
   private function createRoom(
     PhabricatorUser $creator,
     array $participant_phids) {
diff --git a/src/applications/conpherence/__tests__/ConpherenceTestCase.php b/src/applications/conpherence/__tests__/ConpherenceTestCase.php
--- a/src/applications/conpherence/__tests__/ConpherenceTestCase.php
+++ b/src/applications/conpherence/__tests__/ConpherenceTestCase.php
@@ -33,5 +33,43 @@
       ->applyTransactions($conpherence, $xactions);
   }
 
+  protected function addMessageWithFile(
+    PhabricatorUser $actor,
+    ConpherenceThread $conpherence) {
+
+    $file = $this->generateTestFile($actor);
+    $message = Filesystem::readRandomCharacters(64).
+      sprintf(' {%s} ', $file->getMonogram());
+
+    $editor = id(new ConpherenceEditor())
+      ->setActor($actor)
+      ->setContentSource(PhabricatorContentSource::newConsoleSource());
+
+    $xactions = $editor->generateTransactionsFromText(
+      $actor,
+      $conpherence,
+      $message);
+
+    return $editor->applyTransactions($conpherence, $xactions);
+  }
+
+  private function generateTestFile(PhabricatorUser $actor) {
+    $engine = new PhabricatorTestStorageEngine();
+    $data = Filesystem::readRandomCharacters(64);
+
+    $params = array(
+      'name' => 'test.'.$actor->getPHID(),
+      'viewPolicy' => $actor->getPHID(),
+      'authorPHID' => $actor->getPHID(),
+      'storageEngines' => array(
+        $engine,
+      ),
+    );
+
+    $file = PhabricatorFile::newFromFileData($data, $params);
+    $file->save();
+
+    return $file;
+  }
 
 }
diff --git a/src/applications/conpherence/__tests__/ConpherenceThreadTestCase.php b/src/applications/conpherence/__tests__/ConpherenceThreadTestCase.php
--- a/src/applications/conpherence/__tests__/ConpherenceThreadTestCase.php
+++ b/src/applications/conpherence/__tests__/ConpherenceThreadTestCase.php
@@ -112,6 +112,47 @@
     }
   }
 
+  public function testAddMessageWithFileAttachments() {
+    $creator = $this->generateNewTestUser();
+    $friend_1 = $this->generateNewTestUser();
+    $policy_exception_user = $this->generateNewTestUser();
+
+    $participant_map = array(
+      $creator->getPHID() => $creator,
+      $friend_1->getPHID() => $friend_1,
+    );
+
+    $conpherence = $this->createThread(
+      $creator,
+      array_keys($participant_map));
+
+    foreach ($participant_map as $phid => $user) {
+      $xactions = $this->addMessageWithFile($user, $conpherence);
+      $this->assertEqual(2, count($xactions), pht('hi'));
+    }
+
+    $caught = null;
+    try {
+      $xactions = $this->addMessageWithFile(
+        $policy_exception_user,
+        $conpherence);
+    } catch (PhabricatorPolicyException $ex) {
+      $caught = $ex;
+    }
+    $this->assertTrue(
+      $caught instanceof PhabricatorPolicyException,
+      pht(
+        'User not participating in thread should get policy exception '.
+        'trying to add message.'));
+    $this->assertTrue(
+      $conpherence->establishConnection('w')->isReadLocking(),
+      pht(
+        'Conpherence object should still be read locked from policy '.
+        'exception.'));
+    $conpherence->endReadLocking();
+    $conpherence->killTransaction();
+  }
+
   private function createThread(
     PhabricatorUser $creator,
     array $participant_phids) {
diff --git a/src/applications/conpherence/editor/ConpherenceEditor.php b/src/applications/conpherence/editor/ConpherenceEditor.php
--- a/src/applications/conpherence/editor/ConpherenceEditor.php
+++ b/src/applications/conpherence/editor/ConpherenceEditor.php
@@ -441,7 +441,14 @@
             PhabricatorPolicyCapability::CAN_EDIT);
         }
         break;
+      // This is similar to PhabricatorTransactions::TYPE_COMMENT so
+      // use CAN_VIEW
       case ConpherenceTransactionType::TYPE_FILES:
+        PhabricatorPolicyFilter::requireCapability(
+          $this->requireActor(),
+          $object,
+          PhabricatorPolicyCapability::CAN_VIEW);
+        break;
       case ConpherenceTransactionType::TYPE_TITLE:
         PhabricatorPolicyFilter::requireCapability(
           $this->requireActor(),