GRANT all ON api.s3_files TO automation;
-- GRANT SELECT ON api.s3_files TO web_anon;

-- we only want to grant access to this resource to patrons. how do we do that? @TODO