Set file permissions and access

I must lock access before I share this file with contractors. Set permissions so Alex, Sam, and Priya have edit rights, External‑Contractor‑Team has view only, and anyone outside the company cannot duplicate or export assets; confirm the effective permission list and tell me if any inherited group rights conflict.

Before I change permissions, make it easy for the legal and ops leads to accept: surface who currently has edit access, flag any external members, and recommend the minimal permission changes to protect assets while keeping Alex and Sam able to work. Call out any groups that will still allow exporting or duplication and suggest the exact toggle to flip.

I just changed permissions and discovered an external agency still has edit rights through a shared group; I am worried about accidental leaks and the legal team will blame me. I cannot tell whether revoking that group's access will break Sam's workflows. Do I remove the group's edit rights now, message Sam about the change, or create a duplicate file for contractors and revoke access on the original? Recommend the safest immediate move and a short message to Sam explaining it.

We keep having mishaps where contractors get edit access or engineers lose access because of inherited group permissions. Where should I change my habit: always duplicate files before sharing, run a preshare permissions checklist, or centralize sharing through a single admins group? Recommend one habit to adopt, two enforcement steps, and a one‑line policy to add to the sharing protocol.