Bucket-scoped read-only ingest. Case-bound credentials, every object access audited.
Scan the product manifest — ontology types, functions, actions, policies, and dataset shells.