AI Access Reviews: Check the Sharing Link as Well as the Name

A publishing studio finishes working with a freelancer. The owner removes the freelancer’s named permission from a launch brief, then asks AI to prepare the handover report. The report says that access has ended. However, the brief still opens through a link available to anyone who possesses it. This is a hypothetical example, but it exposes a precise management mistake: a recorded action has become a broader conclusion than the evidence supports.

For a business owner, the useful question is whether the intended audience can still reach each important item. An AI-assisted summary should make that question easier to answer, while preserving the limits of what was actually checked.

A person and a link are different access routes

Google’s Drive sharing guide separates named recipients from general access. Its “Anyone with the link” option allows a holder to open the item without signing in. Removing a person’s direct permission and changing that wider setting are therefore different checks. Work and school administrators may restrict the sharing options available.

Microsoft’s SharePoint permissions guide makes a similar distinction: an Anyone link permits unauthenticated access, whereas a Specific people link works for the designated recipients. Microsoft also states that access through an Anyone link cannot be audited. Do not read that limitation as saying that every administrative action associated with the file is unrecorded.

The management implication is to ask which route was closed. A deleted invitation, a removed account and a disabled open link describe different actions. Record the action precisely before deciding whether it fulfils the business’s intended outcome.

Look beyond the individual file’s people list

Microsoft’s guidance on managing sharing identifies several routes into an item: direct permissions, sharing links and access through its site. It also explains that inherited access may need to be changed at the parent folder or site. A review limited to one visible name can miss the relevant controlling setting.

Google’s guide likewise explains folder inheritance and its limited-access folder option. Do not assume that every file can be restricted independently of its surrounding folder. Read the current controls for the location you are reviewing before proposing a change.

For a practical review, sketch the route in ordinary language: this person belongs to this group, which can reach this folder containing this file. Ask the responsible administrator to confirm any part you cannot inspect. An incomplete route should remain an open question in the report.

A published version needs its own check

A document can also have a published viewing version. Google’s publishing documentation describes a separate URL, or an embed, for published Docs, Sheets and Slides. Depending on account settings, the audience can be the web, the organisation or a group within it. Google distinguishes stopping publication from changing collaborators’ permissions.

In that workflow, the publishing controls include Published content & settings and Stop publishing. If your review concerns a published version, inspect those controls too. Check the actual destination linked from a website or message; recording a change to the editable original alone leaves the published route unresolved.

Define the audience before changing permissions

Return to the fictional studio. It has three different purposes: a public press pack for journalists, a private pre-launch budget and a client’s final deliverable. A single instruction to stop all external sharing would ignore those differences.

The following is a proposed management routine, not a complete security audit. For each item in scope, record:

• Purpose: what work or communication the item supports.
• Intended audience: who should be able to reach it after the handover.
• Observed route: the relevant named permission, group, folder, link or published destination.
• Decision: what the authorised owner wants to retain or change.
• Evidence and time: what was checked, when, by whom, and what remains unverified.

For the press pack, continued public viewing may be the desired result. For the budget, it may contradict the owner’s intention. The report should expose that decision rather than treat every broadly accessible item as an error.

The MaryChuks guide to individual accounts and staff access provides the wider foundation. This file review adds a narrower question: what routes remain available to each particular item?

Give AI observations it can keep separate

If you ask AI to organise the review, supply authorised observations with a clear boundary. For example, state which files were included, which settings were inspected and which administrator checks are pending. Prefer a minimal record of permissions over copying the underlying confidential documents into the prompt.

Ask for three separate outputs: observed facts, proposed actions and unanswered questions. Require every completed action to retain its evidence reference. A missing field should remain missing; it should not become an inferred assurance that access has ended.

For the launch brief, an appropriate draft report might say: the named grant was removed; the general link remains open; the owner must decide whether that matches the intended audience. That wording gives the next person a concrete decision and avoids disguising an unresolved setting as completed work.

Verify the outcome at the right scope

Microsoft’s external-sharing overview, updated on 7 May 2026, distinguishes removing guest permissions from stopping access through an Anyone link. For the latter, it directs administrators to delete the link or disable that link type for the site. Those options have different scope; a site-wide change warrants checking who else depends on it.

After an authorised change, reopen the saved controls and check the relevant destination. Where appropriate, use a signed-out session to check anonymous viewing and an approved test identity to check a named audience. These answer different questions. A signed-out refusal does not establish what a signed-in group member can reach.

Also confirm that an intended colleague or client can still complete the agreed task. In the studio example, closing access to the budget should not silently break delivery of the client’s approved files. Record the test identity, destination and result without treating one successful check as evidence about every other file.

Keep the final claim proportionate: these items and access routes were checked at this time, with these exceptions outstanding. That is a report another person can act on and review when the business arrangement changes.

Sources

Primary product documentation checked on 27 October 2026. These describe platform controls; the review routine above is editorial guidance.

• Google Drive: sharing, general access and folder permissions.
• Google Docs Editors Help: publishing files and stopping publication.
• Microsoft Learn: SharePoint permissions and link types; page updated 9 October 2024.
• Microsoft Support: managing sharing and permissions.
• Microsoft Learn: external sharing overview; page updated 7 May 2026.