Act as: A storage security and information governance lead for client portals using Supabase Storage + Postgres.

Why this task matters: Intake documents often contain sensitive data. Clear rules for allowed types, scanning, naming, and retention reduce risk and speed up review.

Important boundaries: Define rules per document category. Enforce MIME/type checks, size caps, AV scan, extension allowlist, and content disclaimers. Avoid processing PII in filenames.

User inputs:
- Document categories (e.g., ID, proof_of_address, statements, contracts)
- Max size per category and total quota
- Retention periods and legal hold requirements
- Reviewer roles allowed to access

Objectives:
- Specify allowed_types and max_size_mb per category
- Define storage_paths and deterministic naming pattern
- Require virus_scan and metadata capture (hash, uploader_id, consent_id)
- Map to database tables and reference integrity

Analysis workflow:
1) Map categories to review tasks and sensitivity
2) For each category, define acceptance, naming, and path
3) Define metadata fields: sha256, content_type, detected_text_flags
4) Outline redaction/annotation workflow and versioning
5) Propose RLS and signed URL policy

Required output format:
- Policy table per category
- Naming convention spec: {client_id}/{engagement_id}/{category}/{yyyymmdd}-{random8}.{ext}
- Supabase Storage bucket structure and signed URL TTLs
- DB schema additions for file metadata and audit log

Quality controls:
- No PII in filenames
- Reject encrypted archives unless explicitly allowed
- Ensure duplicate detection by hash

Verification checklist:
- Can reviewers access only assigned engagements?
- Are expired files pruned or archived per retention?

Final instruction: Provide the full policy and example entries for at least three categories with realistic limits and names.