Grants, not URLs: how the vault shares files
Signed URLs are convenient and hard to revoke. The DevSewa vault uses short-lived, single-use grants instead.
The standard way to share a private file is a signed URL: anyone holding it can fetch the object until it expires. That is fine for a product image and worrying for a citizenship scan.
The DevSewa vault hands out grants. A download grant is minted for one file and one subject user, lives at most an hour, and is single-use by default. An upload grant is minted for one owner and limits the kind, content types and size of what it will accept. Grants carry the tenant they were minted under; present one under another tenant and it is refused.
File ids are not secrets, but they are not useful on their own either. Every file operation is signed for the authenticated application’s canonical origin_tenant. A file from another customer answers 404, byte-identical to a file that does not exist, so the vault cannot be used to probe who holds what.
What the console can and cannot do
Revoke is immediate and reversible in the sense that the file stays for audit; delete purges ciphertext through the vault’s own jobs. Both are recorded with the operator and the reason.