[Michael McQuade (giraffesyo)]

Summary

A Cloud Storage policy refused a bucket get or list, or an object list, with projection=full unless it granted getIamPolicy. Real Cloud Storage answers those calls and leaves out the ACLs the caller may not read. The official Go client asks for projection=full on every get and list, so a caller with only roles/storage.objectViewer was refused, though Cloud Storage serves that caller.

The objects.list reference says getIamPolicy is needed "to return object ACLs", but doesn't say a call without it fails. gsutil handles the same case: "JSON API won't return acls as part of the response unless we have full control scope", and it treats a missing acl as normal (ls_helper.py).

Testing

• make check passes.
• New SDK test: with only storage.buckets.get and storage.objects.list granted, the Go client's bucket get and object list succeed with no denials. Before this change the bucket get was refused.
• Request handling only drops a condition, so there's no benchmark run.

Checklist

• make check passes
• New methods are tested through the official client library
• Package documentation says where the stand-in differs from the real API