#evidence

The confident wrong answer is worse than missing evidence

A governance report told us a site had external sharing disabled. The site permitted anonymous links. Nothing was broken: a correct API returned a default value for a property it had never populated, and the default happened to be the safest word in the enum. Here is the mechanism, the code that reproduces it, Microsoft's own documentation of it, and the discipline that catches the whole class.

11 August 2026·7 min read