---
title: Read and Write
description: "Exactly what the Read and Write permissions let someone do, in the app and through AI clients, and why Write always includes deleting files."
section: Access
order: 50
audience: [owner, admin, member]
status: published
lastVerified: 2026-09-15
sources:
  - src/lib/permissions.ts
  - src/objects/routes/objects.ts
  - src/objects/routes/short-links.ts
  - src/mcp/server.ts
---

Rules grant two permissions: **Read** and **Write**. You can tick either or both on each rule.

| | Read | Write |
| --- | --- | --- |
| See the bucket on Overview and browse its folders | ✓ | |
| Preview and download files | ✓ | |
| Create public share links | ✓ | |
| Upload new files | | ✓ |
| Overwrite existing files | | ✓ |
| Delete files and empty folders | | ✓ |
| Create folders | | ✓ |

Most people who upload also need to see what's there, so rules that grant Write usually grant Read too. The **Uploader** role template ticks both.

## Write includes delete

There's no upload-only permission yet. Anyone who can upload to a folder can also overwrite or delete what's in it. If a folder's files must never be deleted, don't give Write there. Instead, have people upload somewhere else, or turn on versioning at your storage provider so deleted files can be brought back.

## Share links need only Read

Anyone with Read on a file can create a public link to it, and anyone with the link can download it until it expires. If some files must never leave the organisation, don't give Read on them to people who might share them. See [share a file](/docs/files/share-links/).

## AI clients

An AI client connected through MCP works within the roles you choose to give it, with the same two permissions:

- **Read** lets it list connections, buckets, and files, and create download and share links (`list_connections`, `list_buckets`, `list_objects`, `create_download_link`, `create_share_link`).
- **Write** lets it upload files (`create_upload_url`).

AI clients can't delete files or create folders, even with Write.

More in [what AI clients can do](/docs/agents/tools/).