How it works
Users should receive only the permissions needed for their role. Public links, inherited permissions, and old accounts often create hidden exposure.
Use role-based access, periodic review, owner approval, and least privilege for shared data.
Common error
Administrator access is rarely the best default just because it is convenient.
Worked example
Review permissions for a shared finance document.
Evidence
Public link: edit allowed
Reviewer role: needs read only
Owner: finance manager
Former contractor: still listedRemove unnecessary public editing and stale access, assign reviewers only the access needed, and have the owner approve the revised sharing model. Verify the intended user experience with allowed and denied test accounts. Ownership is responsibility for access decisions, not permission for unlimited public sharing.
Exercises
5.2.1
A reviewer needs comments but not deletion rights. What principle guides the assigned role?
Show solution
Least privilege: select the narrowest approved role that supports reviewing and commenting without unnecessary destructive actions.
5.2.2
What should a periodic access review compare?
Show solution
Compare current people and roles with actual permissions, sharing links, inherited access, and business need. Record owner approval and remove obsolete or excessive access.