Check who can open a file-sharing link.

1. Define who needs the file

Write down the intended audience and purpose: one reviewer, an existing project group, or a deliberately public resource. Do not select broad access simply because it removes a sign-in inconvenience. The right setting depends on who is authorized to receive the material.

Google Drive distinguishes restricted access from access available to anyone with the link. A link intended for one person can therefore have broader implications if general access is enabled. ATN recommends deciding the audience first, then configuring the link to match. Check that you selected the right file and version before spending time adjusting permissions on an outdated copy.

Sources: [1]

2. Match the role to the task

Drive’s documented roles distinguish viewing, commenting, and editing. A reviewer who only needs to leave feedback may not need the ability to change the underlying file. Inspect the actual role assigned to the person or group instead of relying on the wording of the message you plan to send.

Keep the assignment specific: “review this draft’s wording” is clearer than “take a look.” If editing is appropriate, establish which copy is the working version so several collaborators do not produce conflicting finals. Role selection is an access decision; it does not replace an agreement about the work or authorize a recipient to reuse the content elsewhere.

Sources: [1]

3. Check folder and group access too

Google documents that folder access is inherited by files inside it, and that a file cannot simply reduce someone’s higher access inherited from its parent folder. Its guidance points to limited-access folders when different permissions are needed. Review the surrounding location as well as the file’s direct invitations.

ATN suggests checking whether an existing group, project folder, or organizational setting already grants access beyond your intended audience. Do not assume that removing one individual invitation settles the entire question. If the available controls cannot provide the intended restriction, pause the share and resolve the storage arrangement rather than guessing that a private-sounding filename protects the contents.

Sources: [1]

4. Verify the intended recipient experience

Inspect the sharing summary, then check the link in an appropriate recipient or signed-out context when that matches the intended audience. Your own owner session proves little about what someone else can open. Use an authorized test account where needed; do not change the audience merely to make a test easier.

If access fails, check the account and permission state before replacing a restricted link with a broadly accessible one.

5. Review access when the task ends

Keep a short record of why the file was shared and which audience needs it. Review access after the project changes, a reviewer leaves, or a draft is replaced. Make any change through the storage service’s controls and verify the resulting state.

Do not treat a sharing control as a guarantee that previously viewed information cannot be retained elsewhere. Keep especially sensitive material out of unnecessary review copies from the outset. This workflow is about deliberate access and a reproducible check; it does not automatically change a file’s permissions, contact recipients, or establish that every copy of the material is under your control.