diff --git a/k8s/infrastructure/minio/buckets.yaml b/k8s/infrastructure/minio/buckets.yaml
index 9c2f9f8..fb148f5 100644
--- a/k8s/infrastructure/minio/buckets.yaml
+++ b/k8s/infrastructure/minio/buckets.yaml
@@ -1,3 +1,5 @@
+---
+# Buckets
 apiVersion: minio.min.io/v1alpha1
 kind: Bucket
 metadata:
@@ -5,13 +7,59 @@ metadata:
   namespace: minio
 spec:
   name: riotpiao-models
-  # Bucket versioning for LLM model artifacts
   versioning:
     enabled: true
   tags:
     app: ollama
     layer: applications
     purpose: model-storage
+
 ---
-# Future: Add more buckets as needed
-# Example: terraform-state, logs, artifacts, etc.
+# Policies: define access scopes
+apiVersion: minio.min.io/v1alpha1
+kind: Policy
+metadata:
+  name: policy-ollama
+  namespace: minio
+spec:
+  name: policy-ollama
+  statements:
+    - Effect: Allow
+      Action:
+        - s3:GetObject
+        - s3:PutObject
+      Resource:
+        - arn:aws:s3:::riotpiao-models/*
+    - Effect: Allow
+      Action:
+        - s3:ListBucket
+      Resource:
+        - arn:aws:s3:::riotpiao-models
+
+---
+# Users: service accounts with scoped access
+apiVersion: minio.min.io/v1alpha1
+kind: User
+metadata:
+  name: user-ollama
+  namespace: minio
+spec:
+  accessKey: ollama-access-key
+  secretKey: ollama-secret-key-changeme  # Override via Secret
+  policies:
+    - policy-ollama
+  status: enabled
+  memberOf: []
+
+---
+# Future buckets
+# - terraform-state: for Terraform state
+# - logs: for application logs
+# - artifacts: for CI/CD artifacts
+# - backups: for database backups
+
+# Future users
+# - terraform: read/write terraform-state
+# - logging: write logs
+# - ci-cd: write artifacts
+# - backups: write backups