A meeting-notes access audit should follow the notes, not just the meeting invitation. Identify where the agenda, live notes, transcript, recording links, attachments, and follow-up tasks are stored; then verify who can view, comment, edit, reshare, or change permissions in each location.
Define the note set and its owner
Start with the meeting title, date, organizer, note owner, authoritative note URL, storage location, and retention expectation. List every connected item: calendar invite, shared document, team or channel, meeting chat, transcript, recording, task board, and exported copy. Do not include confidential note text in the permission inventory; record identifiers and approved evidence locations instead.
Record effective roles
For each item, capture the owner, editors, commenters, viewers, groups, external guests, public or organization-wide links, and parent folder or workspace. Google Drive distinguishes Viewer, Commenter, and Editor, and explains that files and subfolders normally inherit a shared folder’s access. Its sharing guidance also notes that reducing access on a single file may require changing the parent folder or moving the file to a more restricted location. Check inherited access before changing the note itself.
Meeting membership does not guarantee identical access to every artifact. Microsoft’s Teams meeting-notes guide says invited attendees can collaborate on notes, while people not directly invited may have limited access and external attendees cannot access or edit meeting notes. Record the actual meeting type, invitation path, and account relationship rather than assuming all attendees see the same thing.
Test the real paths
Use approved test accounts representing the organizer, an internal attendee, an internal non-attendee, an external guest, and a former participant when appropriate. Test opening the note from the calendar, meeting chat, direct link, parent folder, and task notification. Verify view, comment, edit, download, share, and permission-change behavior. Record expected and observed results with timestamps.
Check both before and after the meeting. Notes may be created from an agenda, saved automatically after the meeting, exposed through a recap, or copied into another system. Confirm whether series notes differ from a single occurrence and whether removing someone from a meeting also removes access to the underlying document or folder.
Review sensitive and stale access
Flag anyone who no longer needs the notes, broad groups that include unintended readers, public links, expired contractors, duplicate exports, and editors who can reshare. If notes include personnel, legal, customer, security, health, or financial details, route the access decision to the responsible owner rather than making a broad permission change during the audit.
End with a dated permission matrix and a remediation list. After each approved change, repeat the original access test and verify that intended users still have the access they need. Record untested paths as unknown; do not convert a successful test in one application into a claim that every copied note is protected.
Sources
- Share and manage access to files and folders in Google Drive — Google
- Take meeting notes in Microsoft Teams — Microsoft Support