IAM and Bucket Policy

Preview policy changes first, then apply with explicit consent.

mixed means public reads for public/* and private reads for private/*; writes remain authenticated.