File download endpoints require files.download and are always tenant/environment scoped.
File contents may include KYC documents, contracts, or other sensitive PII. Do not store downloaded files outside approved tenant retention and data-residency controls.