Building a file access matrix for your event
Your event folder has grown to forty people, and no one remembers who was given edit rights or why.
The short answer
A file access matrix lists each folder or file group down one side and each role across the top, then marks whether that role may view, comment, edit or share.
Give access by role and need, review it at set points, and keep the matrix itself where the owner can find it.
Start from roles, not names
List the roles involved: committee chair, secretariat, treasurer, programme lead, venue contact, AV supplier, registration supplier, volunteers, and the project lead if you appoint one.
People change during a long planning period. A matrix built on roles survives a resignation; a matrix built on names does not.
Four levels are usually enough
- View: can read, cannot change.
- Comment: can suggest changes but not edit the text.
- Edit: can change the file, within a version rule.
- Share: can give others access. Keep this with the owner role only.
Group files by sensitivity
Separate folders for open working files, committee-only files such as budget and contracts, and files that hold personal details such as attendee or speaker contact lists.
Whether you may hold, share or keep personal data, and for how long, is a question for your data protection contact. Mark those folders in the matrix so the question is asked before anyone shares them outside.
Suppliers and volunteers
Give suppliers access only to the folder for their own scope, and prefer view or comment. If a supplier needs to edit, name one person at the supplier and record why.
Set an end date against every external access when it is granted, so revoking access is a scheduled task and not a memory test.
Review rhythm
- Check the matrix against the real folder permissions when it is first built.
- Review at each major milestone, such as programme sign-off and final supplier briefing.
- Review again whenever a committee member or supplier contact changes.
- Keep the previous matrix version so you can see who had access when.
Worked example · Fictional example
A two-day forum with eight roles
Fictional organisation and figures, for illustration only.
A fictional manufacturing association plans a two-day forum with a committee of seven and four suppliers. The secretariat discovers that the registration supplier has edit rights to the whole shared drive, including the budget.
The new matrix gives the registration supplier edit rights to one folder, view rights to the programme, and no access to finance. The treasurer holds share rights for the finance folder only. Every external line carries an end date set two weeks after the event.
Use this yourself
File access matrix
Copy this into a spreadsheet. Use V for view, C for comment, E for edit, S for share, and a dash for none. Add an end date for external roles.
- Folders: programme, speakers, budget and contracts, registration, venue, communications, post-event
- Roles: chair, secretariat, treasurer, programme lead, suppliers, volunteers, project lead
- Owner of each folder and deputy
- End date for each external access
- Date matrix last checked against real permissions
| Folder | Chair | Secretariat | Treasurer | Programme lead | Supplier (own scope) | Volunteers |
|---|---|---|---|---|---|---|
| Programme | V | E, S | V | E | V | V |
| Budget and contracts | V | V | E, S | - | - | - |
| Registration | V | E | V | - | E | - |
| Speaker details | V | E | - | E | - | - |
Open the tool: Conference materials and translation-version checker
Handle it in-house, or bring in help?
Your team can usually handle this when
- The secretariat controls the drive and can check permissions directly.
- Few external parties have access and all have a clear end date.
Outside planning help earns its fee when
- Access has been handed out informally over months and nobody can reconstruct it.
- Several organisations share one drive and each assumes another owns the permissions.
Want the matrix built and checked?
A conference project lead can draft the matrix with your owners, compare it with the real folder permissions, and run the review at each milestone. Questions about personal data handling stay with your data protection contact.
Questions organisers ask
Should volunteers get edit access?
Only to the specific working file they update, and with a version rule. For most volunteers, view access to a read-only export is enough.
How often should we review access?
At each major milestone and whenever a person or supplier contact changes. Add an end date for external access when you grant it.
Can we share attendee lists with suppliers?
That is a data protection question. Ask your data protection contact what may be shared, with whom and for how long before the list goes into any shared folder.
Related resources
Content record: Draft. Written from the cited sources and checked by automated rules; not yet independently reviewed.