Core separates images in the Media Library and general documents in the File Library. Both support public/private storage and access scopes, but the URLs and shortcodes are different.
Access contract
public: an asset is only public if visibility, disk, and scope are all public.editorial: internal access to the content team according to effective permissions.admin: authorized administrator access.
Private files are located at private_files/files; private images are at private_files/media. The controller reads the record, session, permissions, storage identity, and path before the stream. Don't put sensitive data on public disks and then just hide the URL.
Insertion
Use the Library File ID for [private_pdf id="123" mode="embed"] or supported card/link mode. The PDF Viewer creates a lifetime HMAC tokenized stream URL; the token is not a public sharing mechanism. Private images are selected via Media Picker and use private media endpoints, not PDF shortcodes.
Feature limits
Scope Core is intended for the public, editorial and admin. Core does not provide a membership/subscriber download policy. Plugins can add to the workflow, but must still call Core guard and not relax access.
Backup public uploads and both private storage. The delete media/file action is not a universal Recycle Bin and can delete physical files. Test access as anonymous, author, editor, non-owner admin, and Site Owner.