Correct ACL Needed for EPM Documents Where Workspace and Product Are Different

I'm trying to get the ACL rule correct for a user to be able to add to his workspace EPM Documents at Released.  His workspace is in a different product than the EPM Document.  I thought that I just needed Read and Download in the Product directory for EPM Documents at Released with the Role that the group is in.  Am I missing something?  I'm on WC 11.0.