A weekly planning routine often looks personal but depends on several shared systems: calendars, task lists, documents, meeting notes, dashboards, and automations. An access audit finds every route into that system and verifies that each person or tool has only the role it still needs.
Draw the routine as a simple map
Start with the weekly review and work backward. Write down where appointments are stored, where tasks are captured, where priorities are summarized, and where completed work is reported. Include recurring meeting documents, shared inboxes, team chat reminders, automation platforms, and any template copied each week.
For each component, record the owner, administrators, editors, viewers, external guests, group-based access, link sharing, and connected apps. Do not combine those categories in one vague member column. The difference matters: Google Calendar distinguishes viewing free/busy information, viewing event details, changing events, and making changes while managing sharing. Microsoft To Do uses invitation links for shared lists and lets the owner limit a link to current members or stop sharing the list. The official Google Calendar sharing guide and Microsoft To Do sharing guide describe those controls.
Check the highest-impact paths first
Review the main calendar before secondary planning pages because it may reveal availability or event details and may allow changes. In Google Calendar, the available roles are not interchangeable: an editor may change events, while the broadest role can also manage sharing. The guide also warns that making a calendar public can expose it on the internet and through search. Record whether each calendar is public, shared to an organization, shared to named people, or exposed by a link.
Then check task lists. Open every list used in the weekly review, inspect current members, and identify the original invitation link. Microsoft says a To Do list owner can limit access to current members and disable the invitation link, or stop sharing to remove all members and make the list private. Check that the person who runs the routine still owns or can administer the list before changing those settings.
Inspect indirect access
Group memberships, delegates, and service accounts can be easy to miss. If a calendar is shared with a group, review the group's current membership. If an assistant or teammate has delegated access, record the business reason and expiry date. Google notes that workspace administrators may have access under organizational controls, so document that administrative path separately rather than assuming the visible sharing panel is exhaustive.
For automations, list the trigger, destination, connected account, and data moved. Examples include copying flagged email to a task list, posting calendar events to chat, or writing completed tasks to a report. Disable only one stale connection at a time, then run a harmless test so a useful weekly step is not silently broken.
Use an evidence-based review table
Create one row per calendar, task list, document, or automation. Useful columns are owner, access route, current role, work reason, last confirmed, change required, verifier, and next review date. Take note of unknowns instead of guessing. A role that cannot be confirmed should remain an open item, not be labeled safe.
Apply changes in a recoverable order: secure ownership, remove public or reusable links that are not required, reduce broad roles, remove stale people, and rotate automation credentials only when their replacement has been tested. Finally, run the next weekly review with the intended participants. Confirm that planners can edit what they need, readers can see the expected output, and former participants cannot enter through an old invitation link. That closing check turns a permission cleanup into a verified routine.
Sources
- Share your calendar with someone — Google
- Create and share lists — Microsoft