Who Needs Access, and at What Level

Reading time: 6 min

Every shared file raises the same question: who gets in, and what can they do once they are there. Access handed out too freely exposes information that belongs in a protected space. Access held too tightly stalls the people who need it to get their work done.

The standard that settles the question is simple. Access follows action. The level of access each person receives depends on what they will actually do with the file.

This article walks you through matching each person connected to a file with an access level based on their actions. It then covers setting those levels in your platform. You finish with an access plan you can explain and defend for any file or folder.

Before You Start

A few items make the planning go quickly.

The file or folder you plan to share
A list of everyone who has asked for access or is affected by the file
A clear sense of what each person does with the information
Owner or administrator rights to change sharing settings
A blank spreadsheet for your access plan

The Process

The steps below take you from a list of names to a set of permissions that match the work.

Step 1. A List of Everyone Connected to the File

You start by writing down every person or team that touches the file in any way. The list covers three groups:

People who create the file
People who rely on it
People who simply want to know it exists

You set up a spreadsheet with one row per person and columns for their name and role. A third column holds what they do with the file.

Step 2. The Action Each Person Takes

The next step is to describe the action each person takes with the file. The description uses plain verbs, such as "updates the weekly numbers" or "checks the schedule before booking clients." This column drives every decision that follows, so specific entries work better than general ones.

Step 3. Write Access for People Who Work With the File Itself

Write access, often called edit access, goes to people who work with the file itself. Their actions include the following:

Updating it
Printing it
Downloading it
Sending it to someone else

Each of the last three actions moves the file outside its protected location. Those actions belong with the people trusted to manage the file, which is why they sit in the same group as updating.

Step 4. Read-Only Access for People Who Use the Information

Read-only access goes to people who use the information in the file to complete their own work or process. They rely on the content, and they do not change or distribute the file. A scheduler who checks staff availability before booking appointments is a good example. The scheduler needs to see the file every day and has no reason to change it.

Step 5. No Access for a Genuine FYI

No access is the right level for people who only need a genuine FYI. There is no action item for them, so an email update does the job. A leader from their team may need access instead, and that leader shares what is relevant with their group.

"Informational use" and "FYI" are different things. Informational use means the person puts the information to work, which calls for read-only access. FYI means the person simply needs to know something happened, and that does not require a key to the folder.

Step 6. The Permission Levels in Your Platform

Cloud storage platforms offer a small set of permission levels. The names vary slightly from one platform to another, and the mapping stays the same:

Write access maps to the edit level.
Read-only access maps to the view level.
The comment level suits people who review a draft and suggest changes without making them directly.

You open the file's share settings and add each person at the level your plan assigns. Anyone the plan places at no access comes off the list. Many platforms also let you block downloads and printing for people at the view or comment level. That setting reinforces the line between the two groups.

Step 7. A Regular Review

Access needs change as roles change. You review the access plan each quarter and whenever a staffing change occurs. The review compares each person's current action with their current level and adjusts any that no longer match.

Worked Example

Riverside Family Dental keeps a patient scheduling calendar that lists provider hours and open appointment slots. Office manager Tanya Reed noticed that nine people held edit access, and two appointment blocks had been overwritten in the same week.

Tanya built an access plan in a spreadsheet and described what each person did with the calendar. She updated provider hours and printed the daily sheet, so she kept edit access as the file owner. Front desk scheduler Jorge Alvarez checked availability before booking patients, and Dr. Priya Shah reviewed her schedule each morning. Both used the information for their own work, so both moved to view access.

Billing specialist Kevin Moore only needed to know when hours changed. Tanya removed his access and added him to a short weekly email update. The four-person hygiene team needed awareness of changes, so Tanya gave view access to team lead Ana Ruiz, who shared updates at the morning huddle.

Tanya applied the levels in the share settings and turned off printing and downloading for viewers. Edit access dropped from nine people to one. The calendar had no overwritten blocks in the following quarter, and Tanya added the access review to her quarterly checklist.