why we stopped locking every document behind a password

a conversation earlier in the week surfaced a small change we've been making without really announcing it: most shared documents now go out open by default, no password, no gate. we still lock the ones that carry genuinely private information, financials that aren't public yet, anything with someone's personal details in it. but the default flipped from locked unless obviously fine to open unless genuinely sensitive.

the old habit made sense for a while. locking everything felt safe, felt careful. but careful and useful aren't the same thing, and i noticed the password step was mostly adding friction for people who had every right to just read the thing, while doing almost nothing to stop anyone who actually wanted to cause a problem. a password on a document that isn't secret doesn't protect anything. it just adds a small tax every single person has to pay to see something that was never dangerous in the first place.

the harder part of this shift isn't the mechanics, it's the judgment call underneath it. you have to actually decide, document by document, whether something is genuinely private or just feels private out of habit. that takes more thought than a blanket rule either way. lock everything and you never have to think about it again, but you also train everyone around you to expect friction as the default, which quietly discourages sharing things that would have helped somebody.

i think a lot of default caution in business works this way. it feels like risk management but it's actually just avoidance of a slightly harder decision. the safe feeling blanket rule is often easier to maintain than the judgment call would be, even when the judgment call produces a genuinely better outcome.

how many things in your own business are locked, gated, or restricted by old habit rather than by an actual, current reason?