What is a stable way to set up permissions for small team office software?

When small teams start using Notion, Google Drive, or Lark, permissions are often set for convenience first, with security gaps patched later; it's only when someone leaves that you realize data is scattered everywhere. I recommend setting up groups by role from the start rather than granting a bunch of individual exceptions. Directories for finance, HR, and client data should be locked by…