The Permission You Inherited: Auditing the Sharing Defaults Already at Work in Your Business
Most software does not arrive with a blank slate. It arrives with a point of view about collaboration: that documents should be easy to share, that guests should be welcomed quickly, and that a link is a perfectly reasonable way to move work along. These are generous instincts. They are also the source of a familiar problem in UK businesses: files, channels and folders that are visible to more people than anyone deliberately intended.
The issue is not that platform defaults are malicious. It is that they are rarely reviewed. A setting chosen during an implementation in one year can persist through changes of staff, suppliers and even business models. By the time a customer list or a draft contract is exposed, the organisation often cannot say who made the decision, when it was made, or whether anyone ever agreed with it.
Why defaults deserve a place on the risk register
Default sharing is easy to overlook because it sits behind the work. Staff use the tools they are given; they do not usually inspect the permission model underneath. A manager may assume that because a document lives in a company account, it is automatically restricted. In practice, the account is often the least restrictive part of the arrangement. The link, the guest invitation and the inherited folder permission are what decide who can see what.
For UK firms, this is not only an information-security question. It is a data protection question. Under GDPR, personal data must be processed securely and access should be limited to those who need it. The Information Commissioner’s Office has long emphasised accountability: organisations should be able to demonstrate that they have considered the risks and put proportionate measures in place. ‘We assumed the default was fine’ is not a strong answer when a spreadsheet containing client contact details has been circulating by link.
Where quiet over-sharing tends to hide
The precise menus differ, but the pattern repeats across the tools most small and mid-sized UK businesses already run.
Microsoft 365 and Teams. Sharing links are the first place to look. A tenant may permit ‘Anyone with the link’, ‘People in your organisation’, or ‘Specific people’. The middle option sounds safe, but in a large or federated organisation it can still be broader than intended. Guest invitations deserve equal attention. A guest may have been added for a single project and remain in the tenant long after the work concluded. Teams channels add another layer: files shared in a channel inherit the channel’s membership, so a channel that was once a small project team can become a wide distribution list.
Google Workspace. The equivalent risks sit in Drive sharing defaults, link-sharing settings and shared drives. A common finding is that link sharing is enabled for a whole organisational unit because it made a pilot easier. Another is that external sharing is allowed without a clear owner. Shared drives are particularly prone to inherited access: a new member added to a drive may gain sight of years of material that has nothing to do with their role.
Slack and similar messaging tools. Messaging platforms are not usually the place where formal documents live, but they are where files are dropped, screenshots are posted and guest accounts are invited. A public channel can be searched by anyone in the workspace. A guest account can retain access to old threads. The risk is less about a single file and more about the accumulated context: pricing discussions, customer details, internal debate.
Shared network drives and cloud storage. Older shared drives are often the least governed. Permissions may have been set by a former administrator, inherited from a folder structure that no longer matches the business, or granted to a contractor whose engagement has ended. These drives are also where the ‘just give them access to the whole folder’ habit persists, because granular permissions take time.
The departure problem
Inherited permissions become most visible when someone leaves. A departing employee’s account may be disabled, but the files they created can remain shared with them personally, or with a group they belonged to. A contractor’s guest account may sit dormant for months. A shared link may continue to work because it was set to ‘anyone’ and no one has reason to revisit it.
A practical departure checklist should therefore include more than disabling the account. It should ask: what did this person own, what did they share externally, which groups were they in, and which links did they create? For smaller firms without a dedicated IT function, this can be handled by a named owner in operations or finance, with a short record of what was checked.
A 30-minute quarterly check
The aim is not a perfect permission model. It is a repeatable habit. A quarterly check can be completed in about half an hour if it is scoped sensibly.
- Review tenant and workspace sharing defaults. Confirm the setting that governs link sharing, external sharing and guest invitations. Record any change and who approved it.
- List external guests and shared links. Export or review the guest list and the most recently created external links. Remove those without a current purpose.
- Sample high-risk locations. Check finance, HR, client delivery and board folders. Look for inherited permissions that grant broader access than the folder’s purpose suggests.
- Check leavers. Compare recent departures against group memberships, shared drives and guest accounts.
- Record the result. A short note — date, scope, findings, actions — is enough. The record is what makes the check defensible.
A short written standard
The audit is stronger when it rests on a written standard. It need not be long. One page can cover the essentials:
- The default link-sharing setting for each platform, and who may change it.
- The rule for guest invitations: who approves them, for how long, and how they are removed.
- The expectation that shared drives and folders have a named owner.
- The requirement to review access at departure and at the end of a contract.
- The quarterly check and the person responsible for it.
This standard should be written in plain English and stored where staff can find it. Its value is not in its length but in the fact that it exists before a question is asked.
Turning assumption into a defensible position
No UK business can eliminate the risk of over-sharing entirely. People will create links, invite guests and inherit folders. What can be changed is whether those actions are visible and whether the organisation has a stated position on them.
A defensible position is not a claim that nothing will go wrong. It is evidence that the business has identified the risk, set a proportionate default, checked it periodically and recorded what it found. That is a more honest — and more useful — posture than assuming the platform’s generosity matches the company’s intent.
