# Filename for assets is exposed even when access policy denies access to "filename_download" field