Two layers decide who can reach a resource: direct roles and general access. Publishing is a separate public-site workflow.
Direct roles
Invite a person to a specific resource when you want precise control. A direct role can be viewer, commenter, editor, or owner depending on the resource and flow.
Direct roles are useful for private resources, cross-workspace review, and temporary access.
General access
General access sets the default audience:
Private - only direct roles and owners/admins with the right authority can access.
Workspace - workspace members can access according to the selected level.
Link - anyone with the link can access according to the selected level.
Link access can be view, comment, or edit. Be careful with edit links: anyone who has the link can make changes.
Access requests
When someone reaches a private resource without access, they can request access. Resource owners and workspace admins can approve or deny from notifications. Approval grants a direct role, usually viewer unless a different role is chosen.
Publishing is different
Publishing freezes a document, table, or artifact into the public site. A published page is not the same as an edit link to the source resource. Source permissions still control who can edit the original.