You can set the permissions in repoInit file and push the changes with in build .Refer: sling.apache.org/documentation/bundles/repository-initialization.html   

Refer : https://experienceleague.adobe.com/docs/experience-manager-cloud-service/content/implementing/content-delivery/caching.html#explicit-invalidation 

You can try it out .If you need more details i will suggest you to raise a ticket to adobe support team as well. Thanks 

Check the supported format in AEM DAM . Refer : https://experienceleague.adobe.com/docs/experience-manager-cloud-service/content/assets/file-format-support.html?lang=en#support-3d-formats 

Kindly referhttps://aem.redquark.org/2018/10/day-20-working-with-user-and-groups-in.html 

Can you share the error log.

If there is no content rollout and content sync then create simple structure like/content-- /brand_name     ----/us              --en    ----/in            --en Thanks 

In Cloud kindly check preview server URL from your instance .

Secure Preview ServerLets you specify the URL path to your secure renditions preview server. That is, after renditions are generated, Experience Manager as a Cloud Service can securely access and preview the remote Dynamic Media renditions (no binaries are sent back to the Experience Manager as a Cl...

Check Content-Type header value