- New capability groups: s3-users, s3-writers, sqs-users, sqs-writers - portfolio-agent: add s3:read, sqs:read - memory-agent: add s3:read, s3:write, sqs:read, sqs:write - Enables portfolio and memory services to access MinIO S3 and message queues via JWT