Myrikeep combines sensitive-data labels with read-only sharing observations and age review. Open Exposure, a finding's detail or a Scan report to review the evidence, its date and its coverage. It never changes permissions.
Sharing levels
A file can have several signals. The highest-priority one becomes its main badge.
| Level | What it means |
|---|---|
Public (public) |
Observed anonymous, discoverable read access, such as a Google anyone permission with discovery enabled |
Anyone with link (anyone_with_link) |
Someone who knows the link can read without signing in |
External (external) |
Observed read grant outside the configured workspace domain boundary |
Organization-wide (org_wide) |
A provider organization/domain grant; an organization link may still require knowing the link |
Broad group (broad_group) |
A broad read-capable group, such as SMB Everyone or Authenticated Users |
Restricted (restricted) |
All required checks for this inspection surface completed without broad or unresolved signals |
Unknown (unknown) |
Evidence is missing, denied, partial or ambiguous; access could not be determined |
Unknown is not restricted. A 403, empty caller-filtered permission list, unsupported/old agent, exhausted budget or unresolved group cannot prove narrow access. Restricted means no broad access found in the checks performed; it is not a list of everyone who can open a file. Network controls, encryption and other rules may further limit access. Observed grants do not prove anyone opened or downloaded the file.
What each source supports
| Connector | Sharing evidence in phase 1 | Age basis |
|---|---|---|
| SMB | Broad file DACL grants; always partial because share ACLs are not inspected | Last-write time |
| OneDrive for Business / SharePoint | Anonymous, organization and external sharing signals; Graph views remain partial | Modification time |
| Google Workspace Drive | Anyone/domain/external grants; owner-complete narrow evidence may be restricted | Modification time |
| Personal Google Drive / OneDrive | Reuses provider sharing checks; Google owner evidence may be complete, OneDrive remains partial | Modification time |
| Local/NFS | Not available for this source yet; no POSIX/NFS/cloud-sharing inspection | Modification time |
| S3 | Not available for this source yet; no bucket policy/ACL/public-access inspection | LastModified |
| Azure Blob | Not available for this source yet; no public container/SAS/RBAC inspection | Last modified |
| IMAP | Not applicable to mail; mailbox delegates/forwarding are not assessed | INTERNALDATE receipt time |
| M365 mail | Not applicable to mail; recipients do not establish effective access | Received time |
| Workspace Gmail | Not applicable to mail | Gmail internal receipt time |
N/A means this source has no applicable sharing check. Unsupported sources and old/disabled checks can instead show Unknown with a reason. Neither badge is a clean bill of health. Directory and group membership are not expanded. Counts describe observed grants, not a total number of effective readers.
In Settings → Exposure checks, owners/admins can enable Check who can open
sensitive files. Under Your company's email domains, enter each internal
domain on its own line, for example example.test, then save. Domains are exact
matches, not wildcard suffixes; list subdomains separately if needed. Up to 50
are accepted. Without a configured domain boundary, recipient/domain grants
stay unresolved rather than being guessed internal or external. Homelabbers can
leave the list empty and still review public links, with that limitation.
Age review
By default, a file not modified in 24 calendar months needs review. Mail uses receipt age and says Received more than 24 months ago. Owners/admins can change the threshold in Settings → Exposure checks (1–120 months). The scan records its threshold; historical scans keep their own settings.
Old does not mean unused or safe to delete. Last-access timestamps may be missing, delayed or affected by scanning. Google viewed-by-me dates describe only the caller. Missing/future dates can leave age unknown. Age and broad sharing can overlap; the same file can need both reviews.
Coverage and freshness
Sharing inspection is bounded and follows classified observations. Read the sensitive-asset denominator, sampled/skipped coverage, assessment status and check date alongside totals. Files with several labels are not several distinct files. Views use dated, per-connection scan evidence; scoped, failed or incomplete scans cannot prove an entire workspace is safe. Review the check date and rescan after permission changes; old evidence does not prove current access.
If you see access_denied, check the agent's read-only metadata access. If you
see rate_limited, timeout or budget_exhausted, narrow the scope or spread
scans and try again. Keep Unknown while the result cannot be verified.
What to do next
For an anyone link, open the file's provider sharing settings and review/remove unneeded access. For external recipients or organization links, ask the owner to narrow sharing to people who need it. For broad SMB grants, ask the file-server admin to review share permissions and inherited file ACLs together. For old mail or files, check ownership, retention and legal-hold needs before archiving or deleting through your normal process. Then rescan.
Myrikeep does not revoke links, edit ACLs, quarantine or delete files through this feature. It stores normalized classes, counts and timestamps with existing file locations, not raw permission lists, recipient addresses or bearer sharing URLs. See what Myrikeep stores and the connector guides for setup requirements and limits.