Public OCR must not inherit private storage signing

When a shared image resolver gains private-storage signing, audit every public computation endpoint that uses it. An OCR response can disclose protected image contents even when it returns neither image bytes nor the signed URL. A caller-controlled canonical URL must not acquire server read privilege merely because its storage origin is trusted. Keep public payload resolution unprivileged, consume inline bytes or an already-authorized temporary grant, or verify actual requester scope and exact source eligibility before private resolution. Preserve an explicit trusted internal read path so the security correction does not break private-mode extraction.

Applies when: Public OCR and trusted server workflows share a private image resolver. Keywords: OCR private storage signing authorization URL resolver derived text disclosure