Added Declarative provisioning for object storage: buckets, identities and access keys are now managed the same version-controlled way as the rest of the platform, so no credential is handled by hand.

What shipped

Storage space and the keys that reach it are now described in version control rather than created by hand, and applied automatically — the same way the rest of the platform is managed.

Why it matters

Every access key is generated automatically and delivered straight to the service that needs it. None is typed by a person, stored in a document, or shared between services, which removes the most common way credentials go astray.

It also means storage granted to one service cannot quietly be reached by another: access has to be requested and reviewed, not assumed.