Permissions conveyed by a presigned url

Are presigned URLs limited to a fixed set of permissions (eg, just read / download on the object it is created for)?  In other words, anyone with a presigned URL can use the URL until it expires, correct?  Further, there is no way to create a presigned URL with other permissions, such as being able to put a new object or assume the permissions of a Role, correct?  Thanks!