Expanding the sharing scope requires explicit confirmation

What it is

Expanding a piece of content's visibility — from named people to the whole group, from inside the organization to anyone-with-the-link, from view up to edit — must pass an explicit confirmation step: who will be included and at what tier, laid out on a confirmation screen for the operator to approve. Shrinking scope (unsharing, downgrading), by contrast, may be lightweight or confirmation-free. The asymmetry follows the asymmetric cost of error: an accidental restriction means "someone temporarily cannot see it" — discoverable and repairable; an accidental expansion means "unintended readers got the content" — unrecoverable, because the fact of having been seen cannot be retracted. The confirmation step is friction designed for exactly this asymmetry.

Why it happens

Scope expansion has two dangerous properties: irreversibility (once new readers have seen the content, unsharing cannot erase their memory or their screenshots) and cascade (every forward of a link is a silent re-expansion, and a permission upgrade often carries the grantee's re-sharing rights with it). Explicit confirmation inserts a display step between action and outcome: it translates the expansion into inspectable information — "visible to all 247 group members," "the link will allow anyone outside the organization to view" — so the operator sees what they are releasing before pressing the button. The step is necessary because the default presentation of expansion grossly understates the consequence: on the screen it is one switch labeled "enable link sharing"; in cognition it is a crowd of unfamiliar readers; the lightness of the switch and the weight of the outcome are wildly out of proportion, and the confirmation screen levers the ratio back. It also creates an accountability anchor: a confirmed expansion has a clear decision record for any later dispute, whereas silent expansions (default drift, bulk-operation side effects) smear responsibility into system design.

Where it stops holding

Confirmation belongs to upgrades of scope and tier, not to every sharing action — granting a colleague view access needs no ceremony, and heavy confirmation on frequent low-risk expansions only trains reflexive clicking that disables confirmation exactly where it matters (the general failure mode of repeated prompts losing their gating power). Grade sensibly: small internal expansions (adding a few people) take light or no confirmation; external visibility, link sharing, upgrades to edit, and flagged sensitive content take heavy confirmation (explicit audience size and irreversibility). Restriction and revocation skip confirmation but give instant feedback so mis-clicks are one-step reversible. Bulk and indirect expansions (moving a folder that re-scopes its contents) must be itemized and confirmed — never smuggled inside the semantics of "move."

Applying it

• Design a dedicated confirmation screen for upgrades: audience size after expansion, tier change, external visibility, and irreversibility stated outright.
• Grade confirmation weight by risk: external visibility / edit upgrades / sensitive content take the heavy path; small internal expansions take the light one.
• Aggregate and display scope changes triggered by bulk or indirect operations (moves, inheritance changes) before execution, inside the same confirmation flow.
• Record confirmed expansions as events (who, when, what scope) for later tracing.
• Verification: walk every path that changes sharing scope (direct edit, forwarding, bulk move, inheritance change) and check that upgrades all confirm and restrictions all offer instant recovery; then track the confirmation screen's abandonment rate — too high means misgrading is blocking low-risk operations too.

Related

• Same group: V3.07.1 Sharing scope must be persistently visible next to the content · V3.07.2 The semantic difference between view, comment, and edit permissions · V3.07.4 The understandability of permission inheritance and exceptions · V3.07.5 Permission changes must notify affected collaborators
• Nearby: V2.09 The Boundary between Awareness Information and Surveillance · V7.04 Content Governance
• Search terms: scope expansion confirmation · irreversible sharing · permission escalation · confirmation dialog