Per, https://directus.io/docs/guides/files/access, there is no mention of which permissions are required for a file to be accessible by:
- The API
- The app
There should be some additional information which explains which permissions are required (other than the asset ID) as its a bit of a guessing game right now to see which perms are required to not make an image break on the app.
Additionally, usually there a 403 error shown in studio when a folder for an image has a permission level higher than the user, so it would be nice to mention this here too.