Angular assets folder exposes internal files as public URLs — choosing what belongs in the build output

I'm designing an Angular workspace (current CLI, standalone app) and need to settle how static files are published. My understanding is that anything listed under the assets array in angular.json is copied verbatim into the output directory and served at a predictable public URL, with no framework-level access control. That makes it easy to accidentally ship internal documentation, mock data, or configuration files simply because they lived in a convenient folder.

The unresolved decision is where to draw the line: route guards protect navigation but not direct asset URLs, and TypeScript visibility modifiers don't apply to files at all. So the only real control seems to be what gets copied into dist in the first place, plus server-side rules outside Angular's scope.

Before committing to a convention, I want to confirm the boundaries:

• Is there any supported Angular mechanism to mark individual asset paths as non-public or excluded per build configuration, or is exclusion from the assets array the only option?
• For files that must ship but shouldn't be guessable (e.g., fetched only after login), is the intended pattern to keep them out of the bundle entirely and serve them from a protected backend endpoint?
• Does the default public path behavior differ enough across recent CLI major versions that I should pin assumptions in documentation?