To view (download) attachments linked to a specific observation the accessing user must have Read observations (3) permission on the feature the observation belongs to.
To modify (create or delete) attachments linked to a specific observation the accessing user must have Modify observations (4) permission on the feature the observation belongs to.