The short answer
Define the attachment population and intended audience from the source authority, stratify sensitive, shared, externally linked, and inherited-permission items, test effective access as allowed and disallowed roles, record broader, narrower, broken, and unknown outcomes, then correct the policy source and retest affected siblings.
Operational checklist
Mark your progress, then save a working copy. Selections reset when you leave this page. A checked box is not an approval or evidence of completion.
0 of 7 marked
Key takeaways
Join attachment identity to permission authority
For each sampled item record source and target IDs, parent record, property/person scope, document class, sensitivity label if approved, source audience, target policy source, direct grants, inherited grants, public/shared links, migration batch, and checksum or integrity evidence.
Use restricted references rather than copying sensitive content into the test sheet.
Test positive and negative access
| Outcome | Meaning | Immediate action | Expansion |
|---|---|---|---|
| Equivalent | Allowed and denied roles match reviewed intent | Retain test evidence | Continue sample |
| Broader | An unintended role or link can access | Contain and notify incident owner | Test same policy parent/batch |
| Narrower | Required role lost access | Restore through approved policy | Test same role/document class |
| Broken | File or policy cannot be evaluated | Hold operational reliance | Inspect migration transform |
| Unknown | Source intent not supportable | Assign authority review | Do not infer from target default |
Correct the policy source before individual symptoms
Determine whether drift comes from parent placement, inherited folder policy, direct grants, group membership, link mode, role mapping, migration transform, or unsupported source evidence. Correct the shared cause where appropriate and retest all impacted items.
NIST least-privilege concepts support effective access review but do not define the organization’s document audience.
Close with effective-access tests and sibling-population retest
Name the reviewed population, cutoff, evidence version, decision owner, unresolved exceptions, next checkpoint, and downstream records updated. Preserve the superseded state; a clean current screen is not a substitute for the correction or exception history.
Reopen the record if the population, authority, source version, external outcome, or dependent report changes after sign-off.
Edge cases
Sources and references
Follow each source to check the underlying claim. Access checks and professional review are different steps.