Nobody decides to lose control of access. It happens one sharing link at a time.
Permission sprawl is the most common finding in every environment we review, and the one leadership is most surprised by. Here's how it happens and how to unwind it.
How sprawl happens
No single decision creates it. Someone shares a folder for a project that ends. A contractor gets access that outlives the contract. A site owner adds the whole department because it is faster than picking names. A link set to "anyone in the organization" gets forwarded. Each choice is reasonable in the moment; the accumulation is not.
Why it matters more than it feels like it does
Most days, sprawl costs nothing, which is why it survives. The bill arrives all at once: during an audit, after an offboarding goes wrong, when a sensitive document surfaces somewhere it should not, or when a compromised account turns out to have had access to far more than anyone realized. Access is the blast radius of every security incident.
The offboarding blind spot
Disabling an account does not undo everything that account set up: links it created, guests it invited, permissions it granted. Offboarding processes that stop at "disable the login" leave a tail of access behind every departure. A proper process includes reviewing what the person shared and owned, not just their credentials.
Unwinding it without breaking work
The wrong move is revoking everything and waiting for complaints. The right sequence: map actual access, compare it to intended access with the people who own each area, fix the highest-risk gaps first, external links and former staff, then restructure group-based permissions so access follows roles instead of individuals.
Keeping it from growing back
Sprawl is a gardening problem, not a construction problem. Sensible sharing defaults, expiring guest access, group-based permissions, and a quarterly access review keep it down permanently. Each piece is small; together they mean you always know who can see what, which is the whole point.