Read, Write, Delete, and Share

Rules grant four permissions: Read, Write, Delete, and Share. You can choose any combination on each rule.

	Read	Write	Delete	Share
See the bucket on Buckets and browse its folders	✓
Preview and download files	✓
Upload new files		✓
Overwrite existing files		✓
Create folders		✓
Delete files and empty folders			✓
Create a public download link to a file	✓			✓
Create a file request for a folder		✓		✓

Most people who upload also need to see what’s there, so rules that grant Write usually grant Read too. The Uploader role template ticks both, but leaves Delete off.

Upload without delete

Write and Delete are independent. Grant Write without Delete for someone who should upload and overwrite files but never remove them. If overwriting must also be impossible, quickS3 cannot currently express create-only access; use a dedicated drop folder and provider-side versioning or retention.

Share works with Read or Write

Share lets someone create public links that work for people outside quickS3. On its own it grants nothing: a download link also needs Read on the file, and a file request also needs Write on the folder.

To let people see files without sending them outside the organisation, grant Read without Share. A Share deny rule blocks both kinds of link below its folder, even if another role allows Share there.

Every link keeps checking its creator’s access. If they lose Share, or the Read or Write it depends on, their links stop working at once. Owners and Admins can also switch each kind of link off for the whole organisation on the Shared links page.

AI clients

An AI client connected through MCP works within the roles you choose to give it:

• Read lets it list connections, buckets, and files, and create download links (list_connections, list_buckets, list_objects, create_download_link).
• Read and Share together let it create public share links (create_share_link).
• Write lets it upload files (create_upload_url).

AI clients can’t create file requests.

AI clients can’t delete files or create folders. A role’s Delete permission currently applies only to the web app.

More in what AI clients can do.