Read and Write
Exactly what the Read and Write permissions let someone do, in the app and through AI clients, and why Write always includes deleting files.
Rules grant two permissions: Read and Write. You can tick either or both on each rule.
| Read | Write | |
|---|---|---|
| See the bucket on Overview and browse its folders | ✓ | |
| Preview and download files | ✓ | |
| Create public share links | ✓ | |
| Upload new files | ✓ | |
| Overwrite existing files | ✓ | |
| Delete files and empty folders | ✓ | |
| Create folders | ✓ |
Most people who upload also need to see what’s there, so rules that grant Write usually grant Read too. The Uploader role template ticks both.
Write includes delete
There’s no upload-only permission yet. Anyone who can upload to a folder can also overwrite or delete what’s in it. If a folder’s files must never be deleted, don’t give Write there. Instead, have people upload somewhere else, or turn on versioning at your storage provider so deleted files can be brought back.
Share links need only Read
Anyone with Read on a file can create a public link to it, and anyone with the link can download it until it expires. If some files must never leave the organisation, don’t give Read on them to people who might share them. See share a file.
AI clients
An AI client connected through MCP works within the roles you choose to give it, with the same two permissions:
- Read lets it list connections, buckets, and files, and create download and share links (
list_connections,list_buckets,list_objects,create_download_link,create_share_link). - Write lets it upload files (
create_upload_url).
AI clients can’t delete files or create folders, even with Write.
More in what AI clients can do.