What changed in signed access, expiring links, and public-vs-private storage boundaries.
Persistent tenant storage and public file URLs should not be the same thing. That was the core storage distinction we needed to enforce more clearly.
Tenant users still need to view, download, and reuse media easily, but that does not mean the platform should hand out stable public links by default. Signed access gives the right balance: smooth usage without unnecessary public exposure.
This change also clarified product boundaries. Master outputs are temporary and can expire on retention. Tenant files are durable, but they remain private unless a user intentionally publishes something as a public asset.
From a security and abuse perspective, this is much healthier. It reduces casual leakage, narrows exposure, and makes the platform a less useful accidental file host.
Good storage design is often about permissions and defaults more than about raw capacity.