A share link grants exactly one thing: the read-only traffic overview (live, visitors, top pages, referrers) — no actions, no settings, no raw events. Tokens are stored hashed, so the URL is shown once at creation; revoking kills it immediately.