I would like to have a never-share publicly option similar to the delete protection but one that can only be edited by administrators. There could also be a global setting that always sets the flag to on or off. It could then be used as a gatekeeper for AGOL objects to be approved for public use.
We have layers that are used in apps that require a staff sign in but the layers sit in AGOL and can be shared inadvertently often when an app won't work and it is shared which shares the layers in it.
