How to review shared-folder access after a project ends
Share
Published
To review a shared folder, check named users, groups, public links and permissions inherited from parent folders. Confirm who still needs access, remove expired access through the authorised owner and test the final settings with an account that represents the intended recipient.
A project ends, but its folder remains available to the freelancer who delivered the artwork. Months later, staff add customer records to the same folder because everyone recognises its name. The original sharing decision has quietly become a new disclosure decision.
A useful access review checks the relationship between the folder, the people using it and the information now stored there. Counting how many names appear in one sharing window is only part of the job.
Choose a bounded starting point
Start with one active client, finance or personnel folder. Record its owner and purpose. Identify the people who should be able to view or edit it, including external collaborators. Ask the business owner to confirm that list before an administrator changes anything.
A rushed review can lock staff out of work they still need. Schedule higher-impact changes with the owner, keep a record of the original permissions and agree how legitimate access requests will be handled afterwards. Preserve evidence if the review uncovers a suspected incident.
Look for every access route
Google’s Drive sharing guidance distinguishes named permissions from general link access and explains how folder permissions can be inherited. Someone may retain access through a parent folder or a group even after a direct permission changes. Work and school administrators can also limit external sharing, and available controls depend on the account.
Use those distinctions as prompts even if your organisation uses a different platform. Check its current documentation rather than assuming that a similarly named button has the same effect.
| Route | What to inspect | Evidence to record |
|---|---|---|
| Named person | Full account address, role and current task | Owner’s decision and review date |
| Group | Who belongs to the group and who can add members | Group owner and membership check |
| General link | Whether possession of the link is enough to open it | Setting before and after review |
| Parent folder | Permissions inherited by the item | Where the permission originates |
| Connected app | Whether a service or automation can read or copy files | Integration owner and required scope |
For connected assistants, use the AI permission register to record the business purpose and systems involved. A human-access review should not leave an unnecessary application connection untouched.
A fictional supplier review
A company hired a designer for a launch. The designer needed draft graphics and a product brief. Six months later, the folder contains customer interview notes. The designer still has editor access through an external-collaborators group.
The owner first separates material needed for the next design task from customer research. The administrator reviews the group’s membership, removes access that has expired and checks the destination folder. A second check confirms that the intended internal staff can still work and that an unauthorised test account cannot open the restricted material.
This does not demonstrate that the designer read the customer interviews. If the records indicate possible inappropriate access, the organisation should assess that separately. The review log should distinguish an unnecessary permission from confirmed use of the information.
Test access without making another leak
Use a harmless test file where possible. Ask an authorised tester to use the appropriate account type, or use an approved test account. Do not send a sensitive link into a public chat to see who can open it.
A signed-out browser can help test an anonymous link, but it cannot establish every user’s access. Group membership, organisation policies and different account roles can produce different results. Record what each test actually covered.
Also consider copies already made. Revoking folder access does not retrieve an attachment, downloaded spreadsheet or screenshot. If a contractor’s work has ended, combine the folder review with the staff and contractor departure checklist.
Leave a manageable review record
Keep the folder reference, purpose, owner, approved audience, external access, changes, tester and next review date. Record unresolved questions with a named owner. Avoid collecting a full copy of the folder’s personal information just to prove that the review happened.
Trigger a fresh review when a project closes, a supplier changes or the folder begins storing a different kind of information. For files released outside the workspace, use a separate spreadsheet privacy check before sharing them.
Common questions
Is a difficult-to-guess link private?
A link that anyone possessing it can open is still transferable. Use the platform’s access controls when the material should be limited to identified people.
Does removing one email address finish the job?
Only if that was the person’s only access route. Check groups, inherited permissions and connected applications as well.
How often should a folder be reviewed?
Choose a frequency based on sensitivity and how quickly the audience changes. Add event-triggered reviews rather than waiting for a calendar reminder after a departure.
Featured image: AI-generated conceptual illustration.
