Sharing a file takes seconds, which is exactly why so many organizations end up with sensitive documents visible to the wrong people. Most cloud storage and document tools use a similar vocabulary for access: viewer, commenter, editor, and owner. The details differ by product, so this article explains the general model and the habits that keep access under control. Always confirm specifics in your own service's documentation, because names and defaults vary and change over time.
The four common roles
| Role | Usually can | Usually cannot |
|---|---|---|
| Viewer (reader) | Open and read; sometimes download or copy | Change content or comment |
| Commenter | Read and leave comments or suggestions | Directly change the content |
| Editor (contributor) | Change content; in many tools also re-share | Transfer ownership; sometimes cannot delete permanently |
| Owner / administrator | Everything, including changing who has access and deleting | Nothing, which is why ownership should be deliberate |
Two details are worth checking in whatever tool you use. First, whether viewers can still download, print, or copy content. Second, whether editors can add other people. Many data leaks begin with a well-meaning editor forwarding access.
The principle of least privilege
Correction, November 2, 2026: An earlier version grouped owners and administrators together and incorrectly described their authority as unlimited. These are distinct roles, and organizational restrictions can limit both.
Give each person the lowest level of access that lets them do their job, and for the shortest necessary time. A freelance proofreader needs comment or suggestion access to one document, not editor access to a whole project folder. A bookkeeper needs the finance folder, not the entire drive.
How folder and file permissions interact
In most services, permissions are inherited: a file placed in a folder takes the folder's access list. Individual files can often be shared with additional people, and sometimes restricted further. Three rules of thumb help:
- Manage access at the folder level whenever you can. It is easier to audit one folder than two hundred files.
- Use groups (for example, "Project-Alpha-Team") instead of individuals when your service supports them. Adding or removing a person from the group updates access everywhere.
- Be cautious when moving files between folders. Depending on the service, a moved file may keep its old sharing settings, take the new folder's settings, or combine both.
Link sharing versus named sharing
Most tools offer two ways to share:
Named sharing
You invite specific people by email address. Only those signed-in accounts can open the item. This is the safer default for anything confidential.
Link sharing
Anyone with the link, or anyone in your organization with the link, can open the item. This is convenient but means the link itself is the key. Links can be forwarded, pasted into public chat channels, or end up in browser history. Use link sharing for low-risk materials, set an expiration date if the tool supports it, and avoid it for contracts, personal data, or financial records.
Step-by-step: sharing a document safely
- Decide the audience. Who exactly needs access, and are they inside or outside your organization?
- Choose the lowest role that works. If they only need to read, make them a viewer. If you want feedback, make them a commenter.
- Prefer named invitations over open links for sensitive content.
- Check the "can editors re-share" setting if your tool offers one, and turn it off when appropriate.
- Set an expiration for external access where available.
- Preview as the recipient if the tool offers a "view as" option, or ask a colleague to test the link.
- Record it. For important documents, note who has access and why in a simple sharing log.
Running a quarterly access review
People change roles, projects end, and contractors leave. A short quarterly review catches stale access:
- List top-level folders and who has access to each.
- Remove people who no longer need access, starting with former staff and completed contractors.
- Look for files shared by link and decide whether each still needs to be.
- Confirm that at least two trusted people can administer critical folders, so access is never trapped with one person.
Advantages and limitations
Advantages of role-based sharing
- Reduces accidental edits and deletions.
- Limits the damage if one account is compromised.
- Creates an auditable record of who could see what.
Limitations
- Terminology and defaults differ between products.
- Fine-grained permissions can become complicated to maintain.
- Permissions do not protect a file once someone has downloaded a copy.
Conclusion
Good permissions are mostly habit: share with named people, grant the minimum role, manage access by folder or group, and review regularly. For more on structuring the folders that make this easier, see How to Design a Shared Folder Structure for a Small Team, and for the broader picture, the Workplace Security Checklist for Small Teams.
Independent and educational. This article is general information, not professional, legal, or technical-support advice. Workplace Productivity Hub is not affiliated with any software vendor. Features, menu names, and limits vary by product and plan and change over time, so confirm details in your own tools' official documentation. See our editorial standards and corrections policy.