A share link is a tokenized public portal for one product's reports: /share/<token>. The URL itself is the capability — anyone holding it reaches the portal — with three compensating controls: an email gate (a viewer must present an email whose domain is on the link's allow list; an empty list admits nobody), revocation (revoking stops the portal immediately, keeping the link's viewer history), and optional expiry.
Nothing is exposed by default: each report shared is a deliberate per-link choice, and a report never on the list is never visible, whatever its state. Viewers are recorded — who passed the gate, how many times they looked, and when last — so the sender knows what landed.
Related: Deliverable