Filtered Spreadsheet Views Are Not Access Controls
Review a worked exposure matrix before sharing research spreadsheets, separating visible rows from file permissions and existing copies.
10/24/20263 min read
A spreadsheet can look different to two colleagues while exposing the same underlying records to both. Hiding rows, choosing a filter view, or collapsing a tab is a presentation choice, not evidence that access has been restricted. Before handing a regional research list to another team, test the permission boundary rather than admiring the cleaned-up screen.
This guide uses a fictional workbook called Territory Research. It contains company facts, internal qualification notes, and named business contacts. The proposed recipient needs only company names and public website links for a supplier comparison. The question is not whether the desired rows are visible. It is whether unnecessary information remains reachable.
Build an exposure matrix, not a screenshot checklist
Create one row for each route into the information: the shared workbook, another tab, a filter change, a downloadable copy, a linked source, and any previously distributed attachment. For each route, record the recipient identity, information available, action allowed, evidence checked, and unresolved limitation.
The initial fictional matrix contains these findings:
Workbook link: the external reviewer is a viewer of the complete file; the displayed regional filter does not establish a separate permission boundary.
Hidden contacts tab: names and internal notes remain in the underlying shared workbook; hiding the tab is not the proposed control.
Copied values: a separate two-column file contains only company names and approved public links; its sharing settings still require review.
Old email attachment: an earlier complete export exists; changing the current workbook does not retrieve that copy.
The last row changes the decision. A safe new handoff does not prove that the earlier disclosure has been resolved. Track the old attachment separately with the appropriate owner.
Choose the smallest useful deliverable
For this task, the researcher creates a separate, approved company-only extract. They do not copy the whole workbook and hide unwanted columns. They transfer only the required values, inspect the resulting file, and check whether formulas, comments, links, or document properties disclose additional information.
The extract receives a clear scope statement: company comparison only, prepared from records checked on the stated date. It does not claim that the recipient has received the underlying qualification evidence. Where evidence is necessary, include an approved public reference rather than a link into a restricted internal record.
This is an original workflow recommendation, not a claim that every spreadsheet product implements sharing in the same way. Google’s filter guidance documents organizing visible data; its filtering features should not be treated as a substitute for checking file permissions.
Test as the intended recipient
Ask an authorized administrator or designated reviewer to verify access using an appropriate test identity. Do not borrow a colleague’s credentials or publish the file temporarily to test it. Confirm the actual identity, file, permission level, and access route being checked.
Record what the reviewer could open and what remained blocked. A successful test of one link does not establish the behavior of every inherited folder permission or existing copy. If a platform cannot provide the required separation, change the deliverable or use an approved system that can.
The acceptance record might say: “Reviewer identity can open the approved extract; the master research workbook was not shared through this handoff; previous attachment remains under separate review.” That is more accurate than “the hidden rows are secure.”
Keep the boundary intact when the file changes
A later refresh can reintroduce excluded columns. Specify an export recipe, a named reviewer, and a check of the actual outgoing file. Do not assume last month’s approval covers a different dataset or audience.
Before release, confirm the task still needs the extract, the recipient is correct, the contents match the approved field list, and the sharing settings match the intended audience. If any check is unresolved, hold the handoff. The practical outcome is a verified, limited disclosure, not merely a tidier spreadsheet view.