CREATE POLICY "Admins manage proof objects" ON storage.objects FOR ALL TO authenticated
USING (bucket_id = 'student-proofs' AND has_role(auth.uid(), 'admin'))
WITH CHECK (bucket_id = 'student-proofs' AND has_role(auth.uid(), 'admin'));