---
title: Glossary
description: "Short definitions of the terms used in quickS3 and in these docs, from access keys and buckets to prefixes, roles, and share links."
section: Reference
order: 50
audience: [owner, admin, member, agent-user]
status: published
lastVerified: 2026-09-15
sources:
  - src/lib/permissions.ts
  - src/objects/organisation.constants.ts
  - src/mcp/consent.ts
---

**Access key.** The pair of values (an ID and a secret) that lets quickS3 use your storage account. Stored encrypted in a connection.

**AI client.** An app like Claude Code or Codex connected to quickS3 through MCP, using roles its user approved.

**Audit log.** quickS3's 14-day record of who did what, and whether it was allowed.

**Backend upload fallback.** A connection setting that sends uploads through quickS3's servers instead of straight to your storage. Off by default.

**Bucket.** A top-level storage container at your provider. Azure calls it a container.

**Bucket scopes.** An optional list of buckets on a connection. Only those buckets appear in quickS3.

**Connection.** quickS3's link to one storage account: provider details plus an encrypted access key.

**CORS.** A bucket setting that tells browsers which websites may send it requests. quickS3 needs it for browser uploads.

**Custom role.** A named set of rules you create that grants access to buckets and folders.

**Deny wins.** If any rule in any of someone's roles denies an action, it's denied, whatever else allows it.

**Key (of a file).** A file's full name in a bucket, including its path, like `reports/2026/q1.pdf`.

**MCP.** Model Context Protocol, the standard AI clients use to talk to tools like quickS3.

**Multipart upload.** Uploading a large file in parts, so an interrupted upload can resume.

**Organisation.** A separate quickS3 workspace with its own people, connections, roles, and audit log.

**Organisation role.** Owner, Admin, or Member: who runs quickS3, as opposed to who can open which files.

**Prefix.** A folder path in a bucket, like `reports/2026/`. Rules use prefixes to limit access to a folder.

**Provider.** The company storing your files, like AWS or Cloudflare.

**Read.** Permission to browse, preview, download, and share.

**Rule.** One line of a custom role: Allow or Deny, Read and/or Write, on a connection, bucket, and optional prefix.

**Share link.** A public download link for one file that expires.

**Signed link.** A short-lived link, made by quickS3, that lets a browser or AI client do one thing to one file directly at your provider.

**Slug.** The short name of a connection in bucket addresses, like `marketing-assets`.

**Write.** Permission to upload, overwrite, delete, and create folders.