A share needs its own recipient, version and lifetime

The risk begins after send

Internal work usually has context: a workspace, colleagues, roles and an organisation account. External sharing changes that context. The recipient may not be an employee, the link may be forwarded, the engagement may end early, and the file may be revised after the invitation is sent. A good sharing model has to remain understandable after all of those things happen.

Treating a share as a first-class object gives the organisation somewhere to attach that context. It can name recipients, identify the file version, define a lifetime, carry permissions and record whether the share is still active.

Identity matters outside the company too

A secret URL can be convenient, but possession of a string is weak evidence of who is using it. A shared folder password is even less precise: every recipient becomes the same principal. For sensitive external work, the product should be able to distinguish the intended recipients without pretending they are employees.

Mailbox proof is one practical way to establish that the person opening the share controls the address that was invited. The exact assurance level can vary by use case, but the important design choice is to make recipient identity part of the sharing workflow rather than an assumption.

Bind access to the content you approved

Version binding solves a surprisingly ordinary problem. A board pack is shared on Monday. Someone edits the internal file on Tuesday. Should the external auditor automatically receive the Tuesday version? Sometimes yes, sometimes no — but the system should not make that decision accidentally.

By tying a share to a known version, Casewelt can make the approved object explicit. If the organisation wants to share a later version, it can do so deliberately and leave a clear record of the change.

Ending access is part of sharing

Expiry and revocation are not cleanup features. They are part of the original access decision. A two-week engagement should be able to end after two weeks, and an administrator should be able to end it earlier without rotating staff passwords or moving the source file.

The audit trail should also survive the share. When access is over, the organisation may still need to know who opened the content while it was live and when the share was revoked.