The sixty-second answer
Sort each link into one of three groups, not two. Company-wide for anything a new hire could be told about on day one. Named people for anything where you can list who touches it — payroll, banking, the merchant account. Private for anything personal or unfinished. Lists that only offer "everyone" lose the sensitive links entirely, which is how a shared list ends up containing nothing worth sharing.
The failure mode of shared link lists
Almost every business has tried this once. Somebody makes a page or a document called Useful Links, fills it with twenty entries, and shares it with the team. Six months later it is half dead and nobody opens it.
The usual diagnosis is that nobody maintained it. That is a symptom. The cause is upstream: the list had one visibility setting, so the moment a link needed to be narrower than "everyone", it could not go on the list. The genuinely important links — the ones where knowing where they are actually matters — stayed in private bookmarks, and the list was left holding the ones nobody needed help finding.
A list that cannot hold your payroll portal is not a list of your business's links. It is a list of the uncontroversial subset.
Three groups, not two
The distinction people reach for is public versus private. It is not enough, because most of the interesting links are neither. They belong to a specific, nameable handful of people.
Company-wide. The test is simple: if a new person asked, would you say "just ask anyone"? The main system you work in, the shared mailbox, the supplier ordering site, the booking calendar. Seeing the link tells them nothing they should not already know. Make these visible to everyone and stop thinking about them.
Named people. Payroll. The bank. The merchant account. The insurance portal. The government filing accounts. These are not secret from the team in principle, but the set of people who actually touch them is small and deliberate. The useful question is whether you could write down the names. If you can, write them down — that list is the setting.
Private. Two kinds. Genuinely personal things that happen to live in a work browser, and things that are not ready. A service you are trialling, an account half set up, a tool you are not yet sure about. Putting those in front of the whole company creates questions you cannot answer yet.
What scoping a link does and does not do
This is worth being precise about, because it is easy to oversell.
Narrowing who sees a link does three real things. It keeps the list short enough that people still read it. It removes a class of accidental click — somebody opening a system they have no business in, then asking why it will not let them in. And it makes the set of people who work with something visible and reviewable, which is useful on its own.
It does not control access. The service at the other end decides who gets in, and it decides that by who signs in, not by who had the address. Anyone determined to find your bank's login page can type the bank's name into a search engine. Scoping a link is organisation, not a lock.
Which means the two jobs stay separate. A link is a signpost. Access is granted at the destination, to a named individual, with their own sign-in. If the only reason three people can do a job is that they share one set of credentials, scoping the link does not fix that and was never going to.
Deciding quickly
Do not build a policy. Two questions settle almost every case.
First: would I tell a new hire about this in their first week? If yes, company-wide. That single question resolves most of the list, and it resolves it toward openness, which is usually right.
Second: can I name the people who touch this? If yes, name them. If the honest answer is "I'm not sure, maybe four or five people?", that uncertainty is itself the finding — something is being used more widely than anyone decided, and that is worth ten minutes of attention regardless of where the link ends up.
Anything left over is private, and that is fine. Private is not a failure state. Some links are nobody else's business.
Reviewing it
Three things make a link list rot: services nobody uses any more, named lists that were right a year ago, and company-wide links that quietly should not be.
All three are cheap to catch if each link has a name attached — who owns this. Once a year, the owner of each one answers two questions: do we still use it, and is the list of people still right. That is a fifteen-minute job for a fifteen-link list, and it is the entire difference between a list people trust and a list people stopped opening.