Could changing sharing permissions alert other users?¶

Yes. Permission changes can send notifications, create audit events, terminate access and provoke action through other accounts or devices.

Preserve all access routes¶

Record object, owner, collaborators, roles, links, inheritance, groups, organisation and timestamps. An unfamiliar entry may be legitimate, and removing direct access may leave group or public-link access active.

Define ongoing deletion, disclosure or safeguarding risk and consider provider preservation first.

Use a narrow control¶

Remove one risky route rather than every permission where possible. Record authority, operator, time, original and new roles, warnings, confirmations and effects on sessions and sync.