# Capstone file permissions: who can edit, review or read?

> **The short answer**: Set capstone file permissions with known accounts and appropriate roles: viewer, commenter or editor. Check parent-folder access and separate restricted data from shared reports. Test the recipient’s access and plan continuity after graduation. Sharing a file does not transfer ownership, and university rules still govern research data.[^1][^2]

**Key takeaways**

- Write down each person’s role before inviting them.
- Inspect parent-folder and file access together.[^1]
- Separate restricted data from broadly shared work.
- Test access with the recipient’s intended account.

![Diagram: Editor, Commenter, Viewer](https://tiswa.app/assets/blog/capstone-drive-permissions/cover-en.webp)

Your supervisor cannot open the report, so you switch the link to anyone-with-the-link. Later you notice that the shared folder also contains interview recordings and raw participant data. The problem is the boundary of the share, not the act of sending a link. Set those boundaries before the project fills with material and the team depends on links scattered across several conversations.

> **tiswa's take**: Use named accounts as the normal choice for internal university work. Public access belongs to material you deliberately intend and are allowed to publish. A convenient link is not enough reason to expose research data to everyone who receives it.

## Google Drive sharing permissions: viewer, commenter or editor?

List team members and their tasks, then choose a role for each. Authors need to edit the working report. A language reviewer may need comments. Someone checking the completed package may only need viewing access. Google distinguishes these roles; granting editing to everyone by default creates unnecessary uncertainty about who can change the work.[^1] Agree on the purpose of access before choosing the setting.

| Person or material | Suggested access | Reason |
|---|---|---|
| Report author | Edit working document | Their task changes the content |
| Language reviewer | Comment on review copy | They propose changes for the author to assess |
| Supervisor | Role agreed for the review | Some reviews require comments, others direct edits |
| Restricted research data | Authorised people only | Team membership does not override data conditions |

This table is a suggested workflow, not a research policy. If the ethics approval or data owner specifies storage and access, follow those conditions. Do not move interviews or records into a personal account because its sharing controls are easier. Ask the supervisor about the approved location before collection begins, rather than discovering a storage restriction after sensitive material has already been distributed.

## Why check the parent folder first?

A file’s access can come from a folder above it. Google explains that some changes must be made at the parent folder, and suggests limited-access folders when a different group needs access.[^1] Changing one visible file setting therefore does not prove that every route to the file has been removed. Check where it lives, who controls that location and which people have access through it.

1. **Classify the material**: Separate the shared report, presentation assets and data that needs restriction. A filename is not an access control.
2. **Invite the correct account**: Check the email address before sharing. A teammate may have both personal and university accounts; agree which one belongs in the project.
3. **Choose the role**: Select view, comment or edit according to the task, then inspect general access and parent folders.[^1]
4. **Test with the recipient**: Ask them to open the file with the intended account and perform their task. Opening successfully does not prove they can comment or edit.

![Workflow: Identify the owner, Set roles, Test access, Review at handover](https://tiswa.app/assets/blog/capstone-drive-permissions/workflow-en.webp)
Test the action the recipient actually needs to perform.

## A five-person project example

Imagine three students writing the report, one analysing data and one checking the presentation. You do not need five isolated personal folders. You need a shared working report, appropriate presentation assets and a raw-data area that follows the project’s approval. Aggregated results may be shareable with the team while identifying records remain restricted. This is an organisational example, not a determination of what your research permission allows.

When the analyst sends a table for slides, check that the workbook does not include unintended hidden columns or additional sheets. Inspect content before sharing: correct permissions do not remove sensitive information inside the file. If restricted material is shared accidentally, stop that access and follow your university’s reporting and response process. Deleting a link from the chat does not establish that the exposure has ended.

## What should you check when a link fails?

If the supervisor says the link fails, ask which account they used and what message appears. They may be signed into a different account, institutional rules may restrict external sharing or the link may point at an old copy. Resolve the specific cause. Avoid opening the entire project publicly to work around one failed invitation. A screenshot of an error can help, provided it does not disclose unrelated account details.

When institutional policy prevents the requested sharing, use university support or the course’s approved delivery channel. Do not bypass the restriction by uploading controlled material to another personal service. A review copy stripped of sensitive content may be appropriate, but the project rules and supervisor determine that decision. Keep the approved working location clear so parallel copies do not become competing sources of truth.

![Checklist: Link scope checked, Sensitive data separate, Owner can retain files, Old access reviewed](https://tiswa.app/assets/blog/capstone-drive-permissions/checklist-en.webp)
Repeat the review when membership changes or the project ends.

## How do you hand over files before an account ends?

Decide who owns the files and who should retain them under university policy. Ownership transfer has account-specific conditions; inviting an editor does not make that person the owner.[^2] Try the handover before accounts expire and ask the responsible person to open the material from their account. Keep only personal copies that the project permits. A successful download is not automatically permission to retain research records indefinitely.

When a member leaves, review their access according to the agreement and remaining need. Changing a role or removing a share controls service access, but it cannot retrieve a copy previously downloaded elsewhere.[^1] Protection begins before sharing. Do not use permissions to punish a teammate or block coursework the group needs; take a collaboration dispute to the supervisor instead of turning the project folder into the dispute.

After organising access, use [capstone version control](https://tiswa.app/en/blog/capstone-drive-version-control/) to prevent conflicting drafts. For a borrowed computer, read [shared laptop project security](https://tiswa.app/en/blog/shared-laptop-project-security/). The [student account security guide](https://tiswa.app/en/blog/account-security-students/) covers login and recovery arrangements that support the file-sharing plan.

The University of Michigan explicitly asks departing members to plan continuity and transfer university work to the appropriate recipient.[^3] That illustrates why institutional policy matters; it is not a rule for Saudi universities. Ask your own university which account services continue and which project materials you may retain.

Organising the tools you already have may be enough. If you need another service, browse [student discounts in Saudi Arabia](https://tiswa.app/en/deals/) after defining the requirement. [Browse student deals](https://tiswa.app/en/join/)

## Questions

### Which Google Drive sharing permissions fit a reviewer?

Choose commenter for someone providing feedback without editing the text, or viewer for someone who only needs to read. Use named accounts for internal work.[^1]

### Does the Google Drive editor permission make someone the owner?

No. Editing is a sharing role; transferring ownership is a separate action with its own conditions.[^2]

### Why can a Google Drive viewer still open a restricted file?

Inspect the parent folder and other sharing routes; access may come from a higher level.[^1]

### Does removing a share delete downloaded copies?

Do not rely on that. Access controls do not retrieve files already saved outside the service.

### What if university policy blocks external sharing?

Use an approved channel or consult support and the supervisor rather than moving restricted data into a personal account.


## Sources

[^1]: Google Drive: share and manage access, https://support.google.com/drive/answer/7166529?hl=en
[^2]: Google Drive: transfer file ownership, https://support.google.com/drive/answer/2494892?hl=en
[^3]: University of Michigan: Google storage and departure planning, https://its.umich.edu/communication/collaboration/google/storage-management