Set global default sharing to something other than "Editor - Can Share" (Workspaces,Sheets,Reports)
For workspaces, sheets, and reports, the default sharing setting is "Editor - Can Share". It would be ideal to be able to configure a global configuration in Admin Center where the default sharing permission was something other than this setting, such as "Viewer" or "Editor - Cannot Share". By having the "Editor - Can Share" as the default, it perpetuates unwieldy permissions by allowing anyone with "Editor - Can Share" or greater to share to anyone which makes access auditing very challenging and also increases risk of unintended data exposure. By default, this applies to workspaces, sheets, and reports (dashboards seem to default to "Viewer" already).