Authorization and collection binding

Knowing a file ID does not bypass authentication.

Administrator sessions can manage files. Service credentials require files:read or files:write. Uploads may bind metadata to a collection and record ID in the same metadata commit.