Permissions Drift: The Quiet Way Team Access Goes Stale
Every team has a version of this moment. Someone opens an old project folder and finds a document shared with a contractor who left eighteen months ago. Or a new starter asks who owns the shared inbox, and the room goes quiet. Or a manager tries to remove access for a leaver and discovers the account is tied to somebody's personal email address.
None of this usually happens because anyone was careless in a dramatic way. It happens because access is boring until it isn't. Permissions are granted in a hurry, forgotten in a hurry, and then quietly carried forward by the collaboration stack like a rucksack nobody has checked since the last trip.
A quarterly access check is a small antidote. Not a security panic. Not a two-week project with a consultant and a spreadsheet the size of a bus timetable. Just a calm, repeatable look at who can get into what, why they still need to, and whether the answer would make sense to a colleague joining the team next month.
The drift is normal, which is why it needs a diary entry
Permissions drift is the gradual gap between how your tools were set up and how your team actually works now. It shows up in predictable places: old guest links in shared documents, admin rights handed out during a busy launch, contractor accounts that were never closed, shared logins for a team inbox, and files that sit in somebody's personal drive because that was the quickest option at the time.
UK teams are especially good at the informal workaround. A small company needs a shared inbox, so someone uses their own login. A freelancer needs to see one folder, so a link gets forwarded. A manager needs to approve something while the usual approver is on leave, so admin access is granted 'just for now.' These are practical decisions, not moral failures. But they pile up.
The useful question isn't 'who messed up?' It's 'what would we find if we looked today?'
What a quarterly key check actually looks like
The phrase 'access audit' can make a small team feel like it needs a compliance department. It doesn't. A quarterly check can be done in forty-five minutes by one or two people, provided they have the right view of the tools.
Start with four plain questions.
1. Who can get in?
List the admins and owners for each core tool: the shared workspace, the chat platform, the file storage, the project tracker, the password manager, and anything that holds customer or client data. You don't need a perfect inventory of every app. Start with the ones that would cause a genuinely bad day if the wrong person had access.
2. Who shouldn't be there any more?
Compare that list with your current team, contractors, and anyone on a temporary arrangement. Leavers are the obvious category, but also look for people who changed roles and kept old permissions, and freelancers whose project ended but whose account is still active. The aim is not to catch anyone out. It's to make sure access matches the work people are actually doing.
3. What is shared outside the team?
Guest links and external sharing are where calm audits often find the most surprises. A link created for a client review in a previous campaign may still be live. A folder shared with a partner agency may now contain newer files nobody intended them to see. Check the sharing settings on your main document stores and collaboration spaces, then decide which links should expire, which should be restricted, and which are still genuinely useful.
4. What is running on a personal account?
This is the quiet one. A shared inbox, a form, a calendar, or a social account that runs through one person's personal login is a single point of failure. If that person is off sick, leaves, or simply changes their email address, the team can lose access to something important. Where you find this, move the account to a shared team-owned login with proper recovery details — and make sure more than one trusted person can get in.
The UK GDPR bit, without the theatre
Since the UK GDPR came into force in 2018, accountability has been part of the furniture for organisations that handle personal data. For small teams, accountability doesn't mean building a legal department. It means being able to answer basic questions: what personal data do we hold, who can access it, why do they need it, and how long do we keep it?
An access check supports that without turning into a compliance lecture. If a client asks who can see their customer records, you should be able to say. If someone leaves, you should be able to remove their access without a scavenger hunt. If a guest link is still live, you should know whether that is deliberate. That is the practical side of accountability: not a binder on a shelf, but a team that can explain its own setup.
It also helps with the less dramatic stuff. Good access hygiene makes onboarding quicker, offboarding less stressful, and handovers less dependent on one person's memory. It reduces the chance that someone keeps using a tool they don't fully trust because nobody has explained who else can see the space.
Make it safe to be in the room
There is a temptation to frame access reviews as a locking-down exercise. That misses the point. The goal isn't to make people feel watched. It's to make the tools safe enough that people can use them properly.
When everyone knows who owns a shared space, who can invite guests, and what happens when someone leaves, the team spends less energy on quiet workarounds. People stop hoarding files in personal drives because the shared drive is clear and well-organised. They stop passing around a single login because there is a proper shared account with a sensible recovery process. They stop guessing whether a guest link is still active because the owner is named and the expiry date is visible.
That is a cultural benefit as much as a technical one. Trust grows when the rules are legible. People don't have to assume the worst about why someone still has access; they can just check.
Put it in the calendar and keep it boring
The best access check is the one that happens before there is a problem. Pick a recurring slot once a quarter — the first Monday, the last Friday, whatever fits — and give it a named owner. Rotate the owner occasionally so the knowledge doesn't sit with one person. Keep a short record of what you found and what you changed. Then close the document and get back to work.
No drama. No blame. Just a team that knows where its keys are, who has a copy, and which doors still need a lock.
