A share carries two decisions, and they are genuinely separate.
The level
| Level | They can | They cannot |
|---|---|---|
| View | Open it and read it. | Change it, replace it, rename it, delete it. |
| Edit | All of that, plus upload a new version, rename, move and delete it. | Change who it is shared with — that stays with the owner. |
And separately: download
A tick of its own. Somebody can be allowed to read a document without being allowed to keep a copy of it.
That distinction is the point of having it. A rate card a subcontractor needs to work from is not a rate card you want them to have a copy of when they go and work for somebody else.
Be honest with yourself about what this achieves. Somebody who can read a document on screen can photograph it. Turning download off raises the effort and removes the accident — the forwarded attachment, the file left in a downloads folder. It is a sensible control, not a guarantee, and it should not be the only thing standing between you and a leak.
Where the level comes from
The record shows which rule granted your access and where it came from — the file itself, a folder above it, ownership, or being an administrator. When somebody asks “why can they see this”, that is the answer, and it is on the screen rather than something to work out.
Owners and administrators
- Whoever uploaded a file owns it and can always reach it.
- An administrator can reach everything. That is what the role is.
- Neither needs a share, and neither shows up as one.
Choosing sensibly
| Situation | Level | Download |
|---|---|---|
| The company handbook | View | Yes |
| A client contract, for reference | View | No |
| The working folder for a live job | Edit | Yes |
| Signed originals, kept for the record | View | No, except accounts |
| Templates people start from | View | Yes |
What edit actually lets somebody do
Worth spelling out, because “edit” on a file store means more than changing a document.
- Upload a new version, replacing what everybody else sees.
- Rename it.
- Move it — which can change who can see it, if it lands in a folder shared more widely.
- Delete it to the trash.
The third of those is the one people do not expect. Somebody with edit on two folders can effectively move a document from the narrow one to the wide one. That is not a loophole — it is what edit means — but it is worth knowing before granting it on a folder full of contracts.
Download off is worth more than it looks
Even granting that a determined person can photograph a screen, turning download off removes the three ways documents actually leak:
- The forwarded attachment — somebody helpfully sends it on.
- The downloads folder — a copy sits on a laptop for two years and leaves with it.
- The accidental upload — the wrong file attached to the wrong email.
None of those is malicious and all three are common. A control that prevents accidents is worth having even when it cannot stop intent.
Where to go next
Something missing or wrong here? Tell us. A question that needed asking usually means a page that needed writing.