START WITH THE PRODUCT STEPS
Read START-HERE.txt first. It states the actual source acquisition, access/privacy limits, manual field mapping and exact next prompt. The original file templates and synthetic examples below are supporting review aids. Some paths need separately supplied documents or source text; a blank worksheet is not a native export or completed integration.

Q07 - Audit existing external-share access against approved recipients and files

Status: Proposed / not tested

WHAT THIS KIT CONTAINS
Exact input scaffolds and synthetic examples for an offline pilot. Header, JSON-shape and fixture-consistency checks validate these files only; they do not test an assistant, product integration, legal decision, PDF inspection or live workflow.

PREREQUISITES
1. Authorized IT-supplied read-only permissions snapshot, full resource→folder mapping, expanded group membership if authorized, link types and inherited access, lawyer-approved file/recipient/permission scope. Staff maps personal identifiers to pseudonymous principal IDs for the pilot. No live confidential resource URLs required.

SETUP
1. Use the separate synthetic example inputs first. Fill a copy of the blank template or input checklist for your own preparation; do not mix fixture information with real records.
2. The false anonymous-coverage flag means the snapshot does not include ALL anonymous links, not that every known Anyone row must be deleted. A basic sharing report cannot support an all-clear.
3. Preserve exact CSV headers. CSV templates contain only a header row. Import ID, hash, page-label and timestamp columns as text; inspect leading zeros and do not enable formulas from untrusted input.
4. Preserve JSON keys and nesting. JSON templates use blank strings, null scalars and nested placeholder rows to expose missing preparation. They are valid JSON scaffolds, deliberately incomplete. Fill all required fields and validate against the supplied schema; semantic checks in this guide remain necessary.
5. Give only the selected synthetic input sections/files and the prompt below to an existing firm-approved private workspace, or perform the clerical comparison manually. Keep expected-result notes separate from the input. For planning checklists, leave unknown requirements explicit instead of inventing them.
6. Compare the draft output with the expected fixture result. A reviewer checks original evidence and all exceptions before any separately approved action. Retain the version, scope and source references with the review.

INPUT RULES
permission/max_permission: view or edit. link_type: direct, specific_people, organization, anyone or group. Treat the supplied rows as effective access only; do not invent inheritance or membership. Coverage booleans permit null for unknown. Check expiry against snapshot_at, not the machine clock.

FILES
- approved.template.csv: Approved recipients, resources, maximum access and validity
- approved.example.csv: Approved recipients, resources, maximum access and validity
- actual_access.template.csv: Read-only effective-access snapshot, including visible broad links
- actual_access.example.csv: Read-only effective-access snapshot, including visible broad links
- contents.template.csv: Explicit folder-to-resource expansion
- contents.example.csv: Explicit folder-to-resource expansion
- coverage.template.json: Preserve nested input structure and validate supplied field types
- coverage.example.json: Preserve nested input structure and validate supplied field types
- coverage.schema.json: Preserve nested input structure and validate supplied field types

COPYABLE OFFLINE PROMPT
Audit these synthetic snapshots against approved.csv. Evaluate supplied effective access only. Flag resources or principals absent from approval, edit where only view is approved, expired approvals, broad links and unresolved inherited/group access. Expand folder scope only using contents.csv; do not invent missing membership. Return resource_id,principal_id,actual_permission,approved_permission,exception,source_ref,approval_ref plus all coverage gaps. Return partial_review_no_all_clear unless every coverage flag is verified true; a missing flag is unknown, never true. Do not label anyone malicious, determine privilege, follow links, grant/revoke access, change expiry, send files or claim complete confidentiality.

INPUTS
approved.csv = resource_id,principal_id,max_permission,valid_until,approval_ref. actual_access.csv = snapshot_id,resource_id,principal_id,permission,link_type,inherited_from,observed_at,source_ref. contents.csv = container_id,resource_id. coverage.json = {snapshot_at,includes_anonymous_links,groups_expanded,inheritance_resolved,all_resources_in_scope}. permission enum=view|edit; link_type=direct|specific_people|organization|anyone|group. Missing information is unknown, not false.

OUTPUT
access-review.csv: resource_id, principal_id, actual_permission, approved_permission, exception, source_ref, approval_ref; coverage_summary with every supplied coverage flag and review_status. Use partial_review_no_all_clear unless every coverage flag is verified true. Even complete supplied coverage does not establish confidentiality or privilege. Derive every finding from the supplied snapshots and approvals.

Use only these synthetic or firm-approved inputs and preserve source row/page IDs. Keep missing or conflicting evidence unresolved. Return a draft for the named reviewer. Do not send messages, connect accounts, change records or permissions, move money, or make legal decisions. Keep source files unchanged. List missing prerequisites before continuing.

EXPECTED SYNTHETIC FIXTURE RESULT
R1/P1 edit exceeds approved view. R2/P1 is unapproved resource exposure. R1/ANONYMOUS is a broad Anyone-link exception and unmatched principal. includes_anonymous_links=false means anonymous coverage is incomplete even though one known Anyone row is present.

LIMITS
- Lawyer confirms authorized disclosure scope; IT verifies effective inherited permissions and report completeness before any separately approved remediation. No rights changes or third-party disclosure. A basic report is insufficient for an all-clear.
- Synthetic data only in the delivered files. No credentials, real client records, live-action scripts, API connection or Make blueprint is included.
- Real use requires firm-approved access, confidentiality, processing terms, retention, product access and reviewer authority. Pseudonymous IDs alone do not anonymize real records.