Share the project, not the link
Most work shared with a client travels as a link. The link usually reaches further than the person who sent it would guess.
In November 2022 the Berlin firm Positive Security searched urlscan.io, a service that scans suspicious URLs, and found shared Google Drive folders, Dropbox transfers, DocuSign signing requests and SharePoint invites sitting in its public results. Nobody had published them. Companies' own security tooling had submitted them for scanning, and misconfigured integrations marked the scans public. When the researchers mailed bait links to addresses at such companies, 9 of 23 came back as public scans. The senders had done nothing wrong. They sent a link to one person, and the link went where links go.
A link is a key that copies itself
Anyone holding an unguessable link can open what it points to. That is its appeal: no account, no invitation, it just works. It is also why it cannot be scoped. A link does not know who forwarded it, which mail filter rewrote it, or which scanner logged it. Revoking it means revoking it for everyone, including the person you meant to send it to, who now has to ask for another.
The people on the other end are not a small risk either. Verizon's 2025 Data Breach Investigations Report, covering 12,195 confirmed breaches, found that third-party involvement had doubled to 30%. Some of that is software supply chain rather than a contractor's inbox, as the report's authors note. The direction still matters. The parties you share with are a growing share of how things leak.
The opposite mistake is the workspace guest
The usual fix for links is to invite the client into the tool. Done crudely, that trades one problem for another. A guest account that sees the whole workspace sees every other client's work, the internal drafts, and the names of everyone on staff. Nobody decided the client should see those things. It was simply the shape of the account on offer.
The principle that should decide this is fifty years old. Jerome Saltzer and Michael Schroeder wrote in 1975 that "every program and every user of the system should operate using the least set of privileges necessary to complete the job." NIST still defines least privilege the same way, as access restricted to the minimum necessary for the assigned task. Tools that host outsiders mostly arrived at it on their own. Slack's single-channel guests, for example, can only access one channel. The guest gets the room the work happens in, not the building.
The job is the project
For work produced with coding agents the room is easy to name. An agent writes a pricing analysis, three revisions of a launch plan and a dashboard for one client engagement. That set of pages is the job. The client should see all of it, comment on some of it, and see nothing else. A link per page fails the first test, since nobody keeps track of nine links. A workspace account fails the second.
Agents raise the stakes on the same principle. An agent publishing on your behalf usually holds a token with everything you can reach. If its job is one engagement, its token should reach one engagement too, so a confused or misdirected agent cannot publish into the wrong client's space.
What we built
Today a thing workspace can hold projects. A project is either open to the whole workspace or restricted to the people added to it, and each person gets a role: owner, editor, commenter or viewer, where a viewer reads and cannot comment. People from outside the workspace can be added to a project as guests. They see that project and nothing else in the workspace, not its other projects and not its member list. Workspace admins can switch guests off, which removes their access at once, and admins always see every project. An API token can be limited to a single project, so an agent working on one engagement cannot reach the rest.
There are limits worth stating. A private artifact inside a project stays private to its author and the people they invite, so a project role does not open it. Guests sign in with the email address they were added under, which is one more step than opening a link. And none of this changes what a public link is. If an artifact is made public, it travels like any other link, and the scanners will find it like any other link.