DigitalOcean Spaces: Enforce Private Default ACL Across Account

DigitalOcean Spaces creates new buckets with public-read ACL unless the creation request explicitly sets acl to private. The API v2 and console do not expose an account-level default-deny policy or a mandatory private ACL setting, so administrators must remember to set the ACL on every Space individually.

Goal: Prevent accidental public exposure by ensuring every new Space defaults to private without relying on per-request ACL parameters.

Constraints: No global default deny rule exists at the account level. The console provides only a per-Space public/private toggle, and the API does not return a creation audit entry that records the selected ACL. Behavior may differ across account tiers or change with future platform updates.

• Can an account-level policy be configured to reject or override public-read ACLs for new Spaces?
• Is there an API endpoint or webhook that audits Space ACL changes at creation time?
• What verification method confirms the effective default ACL for a newly created Space when the acl parameter is omitted?