How should Google Workspace shared drive permissions be set to avoid chaos?

In a small company using Google Workspace, permissions can get messy very quickly. At first, everyone uses 'Anyone with the link can view' for convenience, but after six months, customer contracts, quotes, HR files, and vendor information get mixed together, and external email addresses still have access. I now set up shared drives by purpose: internal operations, customer projects, financial…