Status: IN
Access control implementations default toward permissiveness: S3 allows requests when no policy exists (opposite of AWS IAM's default-deny), and Google Drive short-circuits the full permission inheritance walk for owners — both reduce access-denied friction at the cost of security strictness.
Both storage systems optimize for "access works by default" rather than "access requires explicit grant"
Depends on (SL): s3-policy-default-allow, gdrive-owner-bypasses-permission