Approved resume render outputs from R2. Access should be enforced by Cloudflare Access or another perimeter control.