Origin Access Control only protects the bucket if every viewer path that needs private objects goes through the distribution and the cache key cannot invent anonymous variants. Prefer one OAC-bound origin for the Multi-Region Access Point hostname, emit Cache-Control from the object or a response-headers policy so hashed assets stay long-lived at the edge, and avoid forwarding the full query string or Cookie on the default behaviour — each unique variant becomes its own object and a regional shield cannot collapse what the key already split.

Ops prove-out after wiring OAC and the cache policy: hit a hashed object twice and expect MISS then HIT with a rising Age, then fetch the HTML shell and confirm it stays on a short TTL or purge path. After replacing an object under the same key, run an invalidation for that path (or rely on versioned filenames) and re-check X-Cache until the old body is gone everywhere that mattered — most “update not visible” tickets are an un-invalidated edge object or a query variant still in the key, not a broken origin ACL.