The least complex defensible design is private object storage plus a short-lived signed URL minted only after application authorization succeeds. For a marketplace retaining signed documents until an explicit deletion deadline, the URL is a temporary delivery credential; it is not the retention policy, the user session, or the audit record. Short answer: authenticate the requester, verify tenant and document access against current application state, confirm that the export is ready and still ...