Ni Nayana,
For security reasons, one may never upload directly an object in the “System.Image” table. You should create a new entity in your own domain model, and make that a specialization of System.Image, see screenshot below. Now associate the Candidate entity with that new entity, instead of the System.Image entity. Now you should be able to controll who can access and edit images by setting the Access Rules.
Hopefully this helps!
Kind regards,
Johan