Someone needs to comment on a draft but accidentally receives editing rights to the entire project folder. This happens easily when sharing is treated only as a choice of whether to send a link. Examine the recipient, required role, and scope of the shared material separately instead.
Define the intended contribution
A reader does not need editing rights. A reviewer may use a commenting role where the application provides one. Someone expected to change the content directly needs appropriate editing access. Google Drive, for example, distinguishes Viewer, Commenter, and Editor roles, while organizational settings may restrict the available options.
Use a specific address or a properly maintained group when access should be limited to certain people. Check the address carefully, especially when names are similar. A broadly accessible link is not equivalent to a targeted invitation when the content should not be generally available.
Consider the storage location
Check whether the document inherits access from a parent folder. Existing broad folder permissions may mean that a single-file setting does not restrict access as expected. Inspect effective access rather than only the latest link you generated. Group membership can also matter to who ultimately receives permission.
For outside review, a separate copy in a clearly limited area may be useful. Avoid creating several unmarked master versions. State which file remains authoritative and how comments will return to it. Internal supporting material should not be shared merely because it happens to be in the same folder.
Verify the recipient's experience
Reopen the sharing overview after saving. Check the person, role, and any expiration setting. For important handoffs, ask the recipient to confirm access briefly. A private browser window can test some link properties, but it does not always replace checking with the intended identity.
Record when access should be reviewed or ended. When the work is complete, remove unnecessary permissions at the actual storage location. Deleting the invitation message does not revoke access. Copies already downloaded cannot automatically be retrieved by later withdrawing online permission either. Treat that limitation as part of deciding what to share in the first place.