A folder is shared by its group, not by its permissions alone — cheat sheet

# who, and in which groups
id alice ; id -nG alice              # groups by name
getent group reports                 # the group's members
sudo usermod -aG reports carol       # append (-a!) a supplementary group
sudo gpasswd -a carol reports        # the same; gpasswd -d removes
newgrp reports                       # a shell with the new group, without logging out

# what is there
ls -la /srv/reports ; stat -c '%A %U:%G %n' /srv/reports/*
namei -l /srv/reports/drafts/q4-outline.txt   # every directory on the path, with its bits
sudo su - bob -c 'test -w /srv/reports/budget.csv && echo writable'

# existing files
sudo chgrp -R reports /srv/reports
sudo chmod -R g+rwX,o-rwx /srv/reports        # X: execute only for dirs (and already-executables)
sudo find /srv/reports -type d -exec chmod g+s {} +   # setgid: new entries get the dir's group
chmod +t /srv/drop                            # sticky: only the owner may delete their file

# new files
umask                                # 0022 → 644/755, 0002 → 664/775, 0077 → 600/700
grep -rn umask /etc/profile /etc/profile.d /etc/login.defs ~/.profile ~/.bashrc
# default ACLs ignore the umask:
sudo setfacl -R  -m g:reports:rwX /srv/reports   # what exists
sudo setfacl -R -d -m g:reports:rwX /srv/reports # what will be created
getfacl -p /srv/reports              # mask:: caps named entries; #effective: shows the result
sudo setfacl -R -b /srv/reports      # remove all ACL entries
# ls -l shows '+' when a file has an ACL; the group bits it shows are the mask