A share link is a scoped grant, not permanent access

A shareable link is a capability grant.

Bound it to specific actions (read vs edit vs comment), set an expiry, and revoke or rotate it when the underlying permission changes.

"They have the link" is not the same as "they are an owner forever." Check the grant at request time: who, which object, which action, and whether it is still valid.