Sheet Protection and Permissions

Two different controls get confused with each other. Protection restricts editing inside a file someone can already open — locking a formula column so a collaborator fills in data without overwriting the calculations. Permissions decide who reaches the file at all. Protection is about accidents; permissions are about access, and only the second one is a confidentiality control.

Google states the limit of protection plainly: “This shouldn’t be used as a security measure. People can print, copy, paste, and import and export copies of a protected spreadsheet.” Hiding a sheet is weaker still — “all spreadsheet editors can unhide and view these sheets”, and a viewer who makes a copy “can unhide the sheets”. So a hidden tab organizes a file; it does not conceal anything from someone who has the file.

Sharing roles carry the real boundary. A Viewer can view and, by default, download; a Commenter can additionally comment; an Editor can change the contents and, by default, share the file onward. “Anyone with the link” grants access without sign-in, which is a different decision from naming individuals and is the one most often made by accident. Owners can switch off downloading, printing, and copying for viewers and commenters, though that reduces convenience rather than guaranteeing containment.

The working rules follow. Grant the narrowest access that lets someone do the work, and withdraw it when the work ends rather than when someone remembers. Protect formula columns and validated input ranges so ordinary use cannot break them. And if a column must not be seen, it belongs in a different file — not in a hidden tab, and not behind a protection setting that its own documentation says is not a security measure.

References:

• Protect, hide, and edit sheets
• Share files from Google Drive