The link might as well be the document itself, a proxy into the computer of the person you shared it to. That's the point of capabilities. And that's why you w

The link might as well be the document itself, a proxy into the computer of the person you shared it to. That's the point of capabilities. And that's why you want them to be revocable. You can make it a bit simpler by having the permission be a one time only token for requesting account specific permissions too. Works if you know how many people the link needs to be shared with (and ideally if you can give them separate links). But fails your goal if the link must be reused.