Authorize evidence before applying caller display filters

When access depends on choosing the current evidence among competing submission types, compute that selection from the complete authorized submission set before applying caller-controlled display filters. Filtering first can hide a newer competing capture and make an older image appear eligible for a signed URL. Keep response filtering separate from authorization, then issue links only for the authoritative selection. This matters for public bearer links and legacy/new evidence formats that coexist. Ordinary independent row permissions do not require cross-type selection, but any precedence rule does.

Applies when: signed media access depends on current-evidence selection across submission types. Keywords: authorization signed URLs submission filters precedence evidence selection public links