We want to protect our files but not make it difficult for the team to access them. What works in practice?