Journal
The vault was chosen because the project teams needed to exchange drawings and appointment letters with consultants. Sharing was left on the most open setting so that work would not stall at the gate.
Three years later, the same setting was still on. We listed 214 active links. Forty-one pointed at folders that included signed contracts, not just drawings. Several consultants had changed firms. The links did not care.
The records policy said external access should expire at practical completion. The application had an expiry feature. It was unused. Administrators had never been asked to run a sharing report.
We did not recommend switching sharing off overnight. Project teams still need a path. We recommended a contractor drop area with 30-day links, and a declared-records library with sharing disabled. Existing links were revoked in batches after the commercial team confirmed which projects were closed.
Permission reviews are dull until the day a former consultant still has the board pack. The application will keep the door open until someone tells it not to.