Sharing an artifact: read permission is not write permission

Separate read permission from write permission

This page opens with Beta, a foreign tenant, attempting to write Alpha/report. At sixty seconds the write status is denied, client writes remain zero, and the reader result is null. Enable Grant Beta read access only and finish again. The write is still denied, but the reader receives baseline at generation one, containing eight UTF-8 bytes. A sharing grant is not ownership and does not authorize replacing the object. Actor tenant Alpha owns this fictional object and can write when the other preconditions pass. The grant checkbox configures the teaching policy; it does not mean a foreign caller can grant itself access in a production application.

Inspect the version a shared reader receives

With Beta and its read grant enabled, select Another writer commits first. A separate authorized writer creates generation two containing concurrent, ten bytes. Beta still makes zero writes. Reader version Latest returns generation two, while Generation 1 returns baseline when Retain earlier versions is enabled. Disable history: the separate writer drops the older version, so a pinned generation-one read returns null even with permission. Authorization and object existence are separate requirements. Turn off the read grant: both latest and pinned reads return null. Changing any fixture input begins a fresh independent run; disabling a grant does not erase a previously downloaded copy.

Distinguish the learner inspector from a client response

The diagram and Complete state inspector expose fictional storage and assembly state to you as the learner. They are not a production response body sent to Beta. Only reader represents the content returned by the modeled read check; assembled contains the attempted input, not a successful write. The fixture has no real tenant identity, signed URL, IAM hierarchy, expiry, audit service or remote storage. It illustrates separate read and write checks and cannot certify an application security boundary. Real authorization must derive identity from trusted credentials and enforce policy server-side.

Control the content representation

For the following content and concurrency experiments, switch Actor tenant to Alpha, disable Another writer commits first, enable Retain earlier versions and select Latest. Alpha can attempt writes, so the quota and precondition results now apply. Part kind selects text, a JSON object or an inline file. Fixture content supplies the actual value; Load valid example restores valid text or a JSON object for the chosen kind. Maximum text chunks divides Unicode code points into at most four parts, so it never cuts a surrogate pair in half. It does not split UTF-8 byte sequences. Append later text parts keeps earlier parts; turning it off replaces them at every update. Data and file inputs are single parts, and the two text-only controls are disabled. JSON is parsed and serialized: whitespace and duplicate keys are not preserved. The file part contains base64-encoded text, not an uploaded file.

Find the exact byte boundary

Enter one euro symbol, €, with Text selected. A limit of two rejects the write; a limit of three accepts it. The inline file representation of that same symbol is 4oKs, four base64 characters, but the decoded content limit still counts three bytes. For JSON object input, enter {"n":1} with spaces around it: serialization removes those spaces and the stored body occupies seven bytes. An array, null or malformed JSON produces invalid-part without writing. Next enter ABCDEF as Text, choose three chunks and limit six. Append preserves AB, CD and EF; disabling append stores only EF. Disable Send final artifact marker to refuse a commit even when the content fits.

Separate quota from concurrency

Require matching live generation compares Expected live generation with the current object. With the original text and limit 28, enable Another writer commits first: generation two contains concurrent and expected generation one is stale. Expected two permits generation three. Enable Retry the same write intent: the first write succeeds, but the unchanged expected two fails against generation three. Turn off the generation condition and both attempts write distinct versions. With history enabled this retains 74 content bytes: baseline eight, concurrent ten and two copies of the 28-byte payload. Disable Retain earlier versions and only the final 28-byte generation remains. A per-version limit does not cap accumulated historical content.

Inspect, compare and record

Play reveals the operations over sixty inspection seconds, not simulated network latency. Pause freezes the position; Next operation pauses at the next operation; Restart returns to the beginning while keeping inputs and speed. Inspection scrubs the trace. Speed changes the elapsed inspection rate to quarter, half, normal or double speed. Editing a parameter resets without autoplay; hiding the tab pauses. The wide diagram has readable labels and can be scrolled horizontally with the keyboard on phones. Exact content, the decision trace and Complete state inspector provide text alternatives. Capture baseline saves a comparison, Replace baseline updates it, and Clear baseline removes it. The notebook stores observations locally; Export notes downloads them. Expand experiment and Exit full screen change the view. All values stay in this fictional local fixture; no object is uploaded.