Security
Every read earns its way through.
herdfs puts every decision about who may read or write in one place, the authority. Clients never hold the bucket's keys; they ask for each chunk they read, and the answer expires within a minute. See the architecture.
Identity from your provider
The authority checks every token's signature, issuer, audience and expiry. Unsigned tokens and unknown keys are refused, and a key your provider withdraws stops working within five minutes.
Permissions per path
Read, write or admin, granted to a user or a group on any folder and everything under it. Grants stay with the path, so a moved folder takes the permissions of its new place.
Grants, not keys
Clients get short-lived links for exactly the chunks of the version they may read. Revoke access and no new link is issued; old ones expire within 60 seconds.
History you were meant to see
Access to a file shows its versions from the moment you gained it, not before. Deleted files and expired versions are erased from the bucket, not just hidden. Read the architecture.