The same analytical link can show the sender full data and a lower-privileged recipient something trimmed

What it is

An analytical link passing through the permission system is not a transparent pipe: the sender sees full data under their permissions, while a lower-privileged recipient opening the same link gets data trimmed by row-level or column-level security — the chart is there, the numbers differ. This silent divergence is the most dangerous source of irreconcilable numbers in analytical collaboration, and the share path must handle it explicitly.

Why it happens

The divergence is the product of the permission model meeting the sharing model: row-level security trims data by "who is looking," and the share link carries none of the sender's authority — the recipient is authenticated as themselves. That is usually correct by design (a link must not become a privilege escalation); what is wrong is the silence: the recipient sees the trimmed chart with no cue that "this is not everything the sender saw," and cites the partial chart as complete evidence. The right treatment makes the divergence explicit — when the recipient opens the link and the system can query the trimmed share (it can, from the permission system), show a prominent notice; and warn the sender at share time if the recipient's lower permissions are already known.

Where it stops holding

Permission notices touch a subtle privacy edge: telling recipients "how much you are missing" is safe; telling them "whose data is missing" may itself over-disclose (to the recipient, that is precisely invisible information), so notices stay at the level of scale and fields. A legitimate alternative is sender-initiated authorisation — a "request full access" flow converts the divergence into one explicit permission request rather than silence or escalation. External sharing (outside the organisation) is the high-pressure case: a public link either mounts a deliberately prepared anonymous data slice or is prohibited; there is no "permissions attached" option.

Applying it

• When a share link opens, compute the visibility delta in the permission system and show a prominent notice past a threshold.
• Before sharing, show the sender the recipient's expected visible scope (or warn "permissions differ; the recipient may see less").
• Verification: exchange analysis links between two accounts with different permissions and check whether the interface explicitly explains the data divergence; a silent difference is a defect.

Related

• Same group: U6.10.1 Analytical state must be encodable as a reproducible link or snapshot · U6.10.2 After the underlying data updates, an old bookmark's conclusion may no longer hold · U6.10.3 Bookmarks must record filters and view configuration, not just page position · U6.10.5 Bookmarks need human-readable names to be findable again
• Nearby: U6.10.3 Bookmarks must record filters and view configuration, not just page position · U6.10.1 Analytical state must be encodable as a reproducible link or snapshot
• Search terms: share link permissions · row level security · governed data access