External collaboration rarely ends as neatly as it begins. A supplier receives a folder for a proposal, a consultant joins a project and a customer is invited to comment on a document. Months later, the files may still be accessible even though the work has changed or finished.
A Google Workspace sharing review brings those relationships back into view. The purpose is to confirm who needs access, what information they should reach and who is responsible for the decision. A useful review protects business information while preserving the collaboration that employees actually need.
This article focuses on Google Drive and shared-drive planning within Google Workspace. Available controls and administrative visibility depend on the organisation’s edition, configuration and assigned roles. Confirm the current documentation and tenant settings before changing access, especially where shared drives, external users or visitor collaboration are involved.
Define the collaboration policy in ordinary language
Start with business rules that staff can apply. Which categories of information may be shared externally? Who can approve a new collaborator? When should access end? What should employees do when a partner needs a different level of access?
Avoid a policy that says only to share securely. A project coordinator needs to know whether a supplier can edit a working document, whether a customer should receive a copy or a link, and who can approve an exception for sensitive material.
Distinguish internal working records from materials intended for an external audience. A folder may contain both without anyone having designed that arrangement. Creating a clearer working boundary can be more effective than asking staff to remember which files are safe to share.
Give each collaboration area an accountable owner. The owner confirms the business purpose and continuing participants, while administrators apply the supported controls. If the original project manager has left, assign a replacement before asking IT to decide which external relationships still matter.
Choose a review scope that can be completed
Begin with a defined set of projects, departments or shared drives. A broad request to review everything can produce a large export without a practical decision process. Prioritise areas containing sensitive information, completed projects or frequent external collaboration.
Record the scope and the date of the review. Access can change while the review is underway, so the result should be understood as evidence for a particular period. Assign a process for handling changes made after the initial inventory.
Identify the tools and permissions available to the reviewer. Administrative reporting and investigation capabilities vary, and an individual file owner’s view may not show the entire organisation. State any visibility limits instead of implying that an incomplete inventory proves there are no other exposures.
Collect only the information needed to make decisions. File or folder identity, owner, collaborator, access level, business purpose and review outcome are often more useful than copying document contents into a separate spreadsheet. Protect the review record because it can reveal sensitive relationships and locations.
Separate shared-drive membership from item access
Google’s shared-drive overview explains the team-oriented ownership model and collaboration options for shared drives. That model differs from relying on one person’s working files, but it does not remove the need to review who can access the material.
For each selected shared drive, review membership and the business purpose of each role. Then consider whether individual files or folders have been shared separately. A review that examines only the drive member list can miss the practical questions raised by item-level collaboration.
Google’s file access guidance for shared drives describes how sharing and drive settings affect access. Use that guidance to interpret the actual arrangement rather than assuming every file has an independent permission boundary.
Explain the effective access in plain language to the owner. The useful question is whether a particular collaborator can reach the information they should see, and whether they can reach more. The answer may require examining both the item’s settings and the surrounding drive configuration.
Verify the external person’s identity and purpose
An unfamiliar address is not automatically inappropriate, and a familiar company domain is not proof that access remains necessary. Ask the owner to confirm the person, organisation, role and current business reason. Record unresolved identities for follow-up rather than guessing.
Check whether the invitation went to the intended account. External collaborators may use multiple addresses, and a personal address may have been used during a project even when a company account exists. Resolve the intended identity with the business owner and collaborator through an approved channel.
For groups, identify who controls membership and whether the organisation can obtain enough assurance about the participants. A group name can remain unchanged while its members change. The review should understand that dependency without assuming the reviewer has authority over an external organisation’s directory.
Consider substitutes and staff turnover. A supplier may still be active while the original contact no longer works on the project. Update access to the approved current participants rather than treating an active commercial relationship as justification for every historical invitation.
Match access to the work being performed
Ask what the collaborator needs to do: read a final document, comment on a draft or contribute to an ongoing working area. Approve the access needed for that activity using the available controls. Editing permission should have a clear purpose rather than being selected because it avoids future requests.
Review the breadth of the location being shared. If a partner needs one deliverable, access to a wider project area may be unnecessary. Google’s shared-drive best practices discusses separating internal and external collaboration areas and using item sharing where appropriate.
Treat these as design choices to evaluate, not instructions to restructure everything immediately. Moving files can affect workflows, links and expectations. Plan changes with the owners and test the resulting access before closing the review item.
Where broad link access is present, ask whether that is intentional and approved for the information involved. Do not assume that a link sent only to one person will remain with that person. The review should establish the intended audience and select an appropriate supported sharing method.
Clean up with evidence and a way to resolve mistakes
Classify each reviewed relationship as retain, change, remove or investigate. Include the owner and reason so the administrator can implement the decision without interpreting vague notes. An unresolved entry should have a follow-up date and accountable person.
Before removing access from an active collaboration, confirm the dependency with the owner. A seemingly old folder may support a recurring obligation. Where the purpose cannot be established, escalate through the agreed policy rather than silently making a business decision.
Implement changes in manageable groups and verify the results. Record the item, action, time and administrator. If an authorised collaborator loses necessary access, the support team should be able to find the decision and restore the appropriate arrangement through the normal approval process.
Avoid treating reversibility as a reason for careless changes. A permission may be easy to restore technically while the interruption still delays an external partner. Planning communication and support reduces that avoidable disruption.
Test access from both sides of the boundary
Have an authorised internal user confirm that normal work still functions after the change. Where practical, arrange a controlled check with the intended external collaborator using an approved test item or workflow. Do not ask them to share credentials or forward confidential content as proof.
Test the expected restriction as well as the allowed activity. If a collaborator should access one folder but not the wider project, verify the boundary using the tools and permissions available to the responsible team. Document limitations when the full external experience cannot be observed.
Record account identity and test time. Testing while signed into a different account can produce confusing results. A screenshot of a document opening is incomplete evidence if nobody knows which identity was used.
Remember that removing future access does not retrieve copies already obtained by a collaborator. Address that issue through the organisation’s collaboration agreements and information-handling process where relevant, rather than promising that a permission change reverses every previous disclosure.
Make project closure part of normal work
A sharing review should not be the only time access is reconsidered. Add collaboration cleanup to project closure, supplier changes and staff transitions. The project owner should identify what remains active, what moves into an archive and who takes responsibility for retained information.
Set review dates for long-running collaborations. The appropriate interval depends on the information and relationship, but there should be a reason for continuing access. A recurring review is easier when the original approval recorded that purpose.
Teach employees how to request access changes without creating duplicate copies in uncontrolled locations. If the process is unclear or slow, staff may work around it by downloading and resending files. A practical policy includes an accessible support route.
Maxicon’s IT consultancy services provide a relevant route for discussing collaboration policy and review ownership. For a focused review, contact Maxicon with the Workspace edition, selected collaboration areas and the access questions you need to resolve.
Frequently asked questions
Does a shared drive automatically make external sharing safe?
No. A shared drive provides a particular ownership and collaboration model, but the organisation still needs appropriate membership, sharing settings and business approval. Review the actual access paths and applicable tenant controls. The presence of a shared drive is a starting point for governance, not evidence that every collaborator has the right access.
Should we remove every external user during a review?
No. External access may be essential to an active project or business relationship. Confirm the person, purpose, scope and required access, then retain or change it according to policy. Remove access that is no longer justified through an accountable process, and investigate uncertain entries rather than making assumptions from unfamiliar addresses alone.
Is reviewing the member list enough?
It may not answer every access question. Depending on the configuration, individual items and surrounding drive settings can also affect access. Use Google’s current documentation and the tenant’s available tools to assess the effective arrangement. State the review’s visibility limits so the final report does not imply broader coverage than was actually achieved.
Can access removal undo files already downloaded?
A permission change governs future access through that sharing route; it should not be presented as retrieving every copy already obtained. Handle information already shared through the organisation’s agreements and approved procedures where necessary. This is one reason to assess the audience and sensitivity before collaboration begins, as well as during periodic reviews.
What should a completed sharing review contain?
Keep the defined scope, review date, owners, decisions, implemented changes, validation results and unresolved items. Each exception should have a reason and next review point. The record should help another authorised person understand why access remains, without duplicating unnecessary document contents or becoming a new uncontrolled store of sensitive information.
Related technology support
For an additional service perspective related to this guide, explore Trubyte’s cloud and collaboration services.
Discuss your requirements with Maxicon
Tell us about your business, current environment and the support you need.
