{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T01:25:58.088Z",
  "record_id": "VXI-EXT-PROCUREMENT-SHAREPOINT-LINK-AUDIENCE-01-v1",
  "record_kind": "external_reference",
  "title": "SharePoint links: Transferable access and remaining grants",
  "system": "SharePoint and OneDrive links",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does sending a SharePoint link to one recipient limit access to that person?",
  "near_questions": [
    "Does privately sending a link restrict it to one person?",
    "Can an Anyone link be forwarded outside the organisation?",
    "Does deleting a sharing link remove other permissions?",
    "Which SharePoint link type was actually created?",
    "What evidence supports a named-recipient access claim?",
    "Can an agent infer privacy from the delivery channel?",
    "Does revoking one link revoke every access route?",
    "How do organisation links differ from Anyone links?",
    "What should procurement ask about transferable file access?",
    "Which permission evidence should a sharing review retain?",
    "Can I save a SharePoint link-audience review?",
    "When should a recreated link be checked again?"
  ],
  "supported_claims": [
    {
      "claim": "Not necessarily. Microsoft describes Anyone links as transferable: another holder can use the link. Deleting a link revokes that link, while other permissions can still provide access. Review the link type and independent grants before claiming a named-only audience or complete revocation.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Not necessarily. Microsoft describes Anyone links as transferable: another holder can use the link. Deleting a link revokes that link, while other permissions can still provide access. Review the link type and independent grants before claiming a named-only audience or complete revocation.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-ATLASSIAN-APP-COVERAGE-01-v1",
    "VXI-EXT-PROCUREMENT-NOTION-INHERITED-SHARING-01-v1",
    "VXI-EXT-PROCUREMENT-DRIVE-FOLDER-INHERITANCE-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "SharePoint link audience and transferability",
    "source_url": "https://learn.microsoft.com/en-us/sharepoint/shareable-links-anyone-specific-people-organization",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SHAREPOINT-LINK-AUDIENCE-01-v1",
    "candidate_record_sha256": "55c4aa260ced4aa41f8d02695cab4e24e99b880a776c838c7573154963931e82",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Not necessarily. Microsoft describes Anyone links as transferable: another holder can use the link. Deleting a link revokes that link, while other permissions can still provide access. Review the link type and independent grants before claiming a named-only audience or complete revocation.",
    "required_buyer_context": "Link type, file or folder, intended recipients and other resource permissions.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "A privately sent link is restricted to its named recipient.",
    "documented_statement": {
      "status": "documented",
      "statement": "Not necessarily. Microsoft describes Anyone links as transferable: another holder can use the link. Deleting a link revokes that link, while other permissions can still provide access. Review the link type and independent grants before claiming a named-only audience or complete revocation.",
      "source_ids": [
        "sharepoint-links"
      ]
    },
    "buyer_evidence_required": [
      "Actual link type and current link settings",
      "Intended audience and independent resource grants",
      "Revocation evidence for every access route within scope"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Clarify link audience before sharing sensitive content or claiming revocation."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "sharepoint-links",
        "url": "https://learn.microsoft.com/en-us/sharepoint/shareable-links-anyone-specific-people-organization",
        "final_url": "https://learn.microsoft.com/en-us/sharepoint/shareable-links-anyone-specific-people-organization",
        "title": "SharePoint link audience and transferability",
        "checked_on": "2026-10-14",
        "sha256": "bb23d183afc6aadc0f0826d368232f45aefd51918757cdfb2ddfe97990d257fc",
        "bytes": 54487
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save the link-audience distinction behind a collaboration procurement decision.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck link recreation, forwarding policy and other grants."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#sharepoint-anyone-link-audience-evidence",
  "machine_readable_record": "/varexis-index/records/sharepoint-anyone-link-audience-evidence.json"
}