Organization Scoped Sharing Link, Discover and Check Permissions

Thanks, StephenRice, that does help a bit. I'm still puzzled by the "Discover" feature, though. It seems like it would be useful in a smaller and more peer-based organization, where it's easier to keep the "sensitive documents" under tighter control. However, in an academic environment with ~40,000 users, about ~5,000 of which (faculty and staff) have their own definition of "sensitive", it seems like it's a big problem just waiting to happen. 

There's no clear documentation (that I've found, anyway) as to what shows up in Discover and how. It's all based on MS/Office Graph, but what does that really mean in practical terms. In this particular example, let's say that org-scoped sharing link was created and sent to one employee. That employee happens to be in regular correspondence with a particular student. The employee gets the email and opens the document. Does Graph see the situation and say (in simplified terms, obviously): "that student is conversing with that employee and that employee just opened a file that the student also has access to via that link...let's show that to the student since they may want to see it, too!"

To clarify, I'm taking the student at their word when they say "I found the document in the Discover section of the Outlook app" and trying to figure out how it ended up appearing there. I have not seen proof that the student saw it there, but I do have a record (from the audit log) that they accessed the file, so it's reasonable to assume they're being honest. What we don't seem to have is a way to determine to whom that org-scoped link was sent (except to ask the person who sent it). So, there are a few gaps in the audit trail, which makes it hard to know exactly what happened.