# The NDA Case Study Score, Each Element to Publish, Recreate, Gate, or Cut

*Take one confidential project, score every element on six dimensions, and leave with a verdict per element plus a written permission request for anything gated.*

- Canonical URL: https://www.refolk.ai/candidates/guides/nda-case-study-element-score
- Pillar: Positioning and materials
- Format: Framework
- Published: 2026-11-10
- Last reviewed: 2026-11-10
- Reading time: 23 min
- Keywords: how to show NDA work in portfolio, can I put confidential work in my portfolio, anonymize case study under NDA, password protected portfolio for recruiters, portfolio when all my work is under NDA, can I share metrics from my old job on my resume

## Key takeaways

- A password changes who can see a page, not whether you disclosed: no legal source I found treats gating as a cure, so raw confidential material needs written permission before it goes behind one.
- Hrdy and Seaman found that almost all employee confidentiality agreements last indefinitely, so the fact that a few years have passed is not an expiry date. Read the survival clause.
- 73% of workers in computer or mathematical jobs report having an NDA with their employer, so the design leader reviewing your portfolio has probably worked under one too and will expect clearly labelled gaps.
- In Brown v. TGS, a California appeals court voided an overbroad confidentiality clause and reversed a $3.4 million award, but said a properly drawn confidentiality agreement stays enforceable.
- For an ordinary employee, the real limit on sharing company metrics is usually the company's own disclosure policy, not Regulation FD, which reaches employees only when they act at senior management's direction.
- Score each element on four risk dimensions (0 to 8 in total), one proof-value dimension, and a permission override. Anything at risk 6 or above without written permission gets Recreate or Cut, never Gate.

This standard is for anyone whose strongest recent work is covered by an NDA or an employee confidentiality agreement and who still needs a portfolio and resume that prove that work. It breaks one confidential project into separate elements, scores each one on six dimensions, and gives it one of four verdicts: Publish, Recreate, Gate, or Cut. You come away with a public summary, a gated deep dive, a matching resume line, and a written permission request for anything that needs one.

## What the four verdicts mean

Every element of a confidential project gets one of four verdicts: Publish it openly, Recreate it with invented data, Gate it behind a limited-audience format under written permission, or Cut it. You decide per element, never per project. A single project almost always yields more than one verdict.

- **Publish.** It goes on the open web as it is. It is either not confidential, already published by the company, or covered by written permission for public use.
- **Recreate.** You rebuild it with invented data, neutral branding, and the real structure and reasoning intact. The recreation proves your thinking without carrying the protected facts.
- **Gate.** Only a limited audience sees it, through a password page, an expiring link, or a live walkthrough in an interview. It applies **only** when you have written permission that allows that audience. Until that permission arrives, a Gate element is handled as Recreate or Cut.
- **Cut.** It stays out of everything. It is too risky for the proof it adds, or it is off-target for the role.

Most advice lists these tactics without matching them to elements. That produces two predictable failures: raw screenshots behind a password, which feels private but may still be a breach, or a portfolio emptied out of caution until it reads like a student's. The score below makes the call one element at a time.

> A password changes who sees the page. Nothing I found says it changes whether you disclosed.

> **Note:** This is a working standard, not legal advice
>
> Where a verdict depends on a clause you cannot read with confidence, the check is a written permission request or an employment lawyer, not this rubric. The rubric tells you which elements need that check.

## Which documents decide what you can show

What you can show is decided first by the agreement text, second by the company's own disclosure policy, and only at the edges by general law. Read all three in that order, and do not let a headline about one court case stand in for the text you signed.

### The agreements themselves

Collect every document that might contain a confidentiality term:

- Offer letter
- Separate confidentiality or invention assignment agreement
- Contractor NDA
- Master services agreement and statement of work
- Severance agreement

Agency staff should check client contracts as well. In an agency setting, the NDA may not have been a separate document.

From each document, pull out four things:

1. **The definition of confidential information.** This is the sentence that says what counts.
2. **Duration.** This is usually in a survival clause, the term that says which obligations continue after the agreement or employment ends.
3. **Any portfolio or publicity clause.** The AIGA Standard Form of Agreement for Design Services treats portfolio usage as a core term and tells designers to describe their portfolio rights explicitly. AIGA notes that its form is a studio-client agreement, not an employment agreement, but suggests its Section 6 as a model when negotiating portfolio rights with an employer. AIGA Portland warns that an NDA can override a portfolio clause, so a portfolio right in one document does not cancel a confidentiality term in another.
4. **Any return-of-materials clause.** I have not found reliable sources on typical wording. If yours requires you to return or destroy materials, your old files may not be yours to recreate from, and that pushes the element toward Recreate-from-memory or Cut.

### How long the obligation lasts

Assume the obligation is still running. In their Yale Law Journal study, Hrdy and Seaman found that almost all of these contracts last indefinitely and have no geographic boundaries. A clause with no end date is in force today.

### Where the law narrows overbroad clauses

*Brown v. TGS Management Co.* is a California appeals case. The court reversed a $3.4 million arbitration award because the employer's confidentiality clauses, part of a 12-page agreement signed in 2005, worked as a de facto noncompete. They swept in information unrelated to the business and information that predated the employee's time there. The court held the clauses void ab initio, meaning void from the start. It also said a properly drawn confidentiality agreement that preserves the employee's right to compete remains enforceable. The reasoning rests on California's Section 16600 and does not carry over to other states as is.

Hrdy and Seaman note that published NDAs often reach an employee's "general knowledge, skill, and experience." No court has applied the line between confidential information and general skill to specific portfolio elements like process, screens, or metrics. The mapping I use below is my own reasoning, not established law.

The NLRB's *McLaren Macomb* decision restricted broad confidentiality terms in severance agreements for non-supervisory employees. The general counsel memo that expanded on it was later rescinded. Venable reads *McLaren* as still the standard the Board and its judges follow, because general counsel memos are not binding. Venable also says such clauses are likely still enforceable in severance agreements involving supervisors. To re-check this, look for a Board decision that overrules *McLaren*. A memo alone does not change it.

### The company's disclosure policy

For metrics in particular, the company's own policy usually binds you more tightly than federal law. Regulation FD is the SEC rule on selective disclosure of material information, adopted in August 2000. It generally does not reach statements by ordinary employees unless they are acting at the direction of senior management. Company policies go further. The SEC charged DraftKings over social media posts that discussed growth before the company had released its quarterly results. DraftKings' own policy banned sharing confidential financial or performance information without prior written approval from its communications team. ADM's policy says no employee is authorized to communicate material nonpublic information. If your former employer is publicly listed, find its disclosure policy before you write a single figure.

## How common NDA-bound work is, and what reviewers expect

Confidential work is the normal state for most people reading this, and that includes the people reviewing your portfolio. A labelled, partly recreated case study is something reviewers recognise. An unexplained two-year hole is not.

**73% - of US workers in computer or mathematical jobs report having an NDA with their employer**

Across all US employees, an estimated 57% were definitely or probably bound by a confidentiality agreement, and another 8.5% did not know.

| Population | Bound by an NDA |
|---|---|
| All US workers | 57% |
| Computer or mathematical jobs | 73% |
| Professional, scientific and technical services | 70% |
| Construction | 41% |
| Firms using NDAs for some workers | 88% |

Sources: Hrdy and Seaman (Yale Law Journal), the Federation of American Scientists, and Sockin's research on NDA incidence. The all-workers figure dates from a 2017 survey.

The 8.5% who do not know whether they are bound is worth taking seriously. If you cannot say which of the five documents above you signed, you are in that group until you find them.

### Who reviews the portfolio

Design portfolios are usually read by design leaders. In Refolk's index of professional profiles, that group is large and dominated by one title.

**16,482 - current US profiles titled Design Manager, Director of Design, Head of Design, or Design Director**

From Refolk's index of professional profiles. In a 25-profile sample of this group, 11 held the title Head of Design.

| Title | Sample count (n=25) | Share |
|---|---|---|
| Head of Design | 11 | 44% |
| Design Director | 4 | 16% |
| Design Manager | 2 | 8% |
| Other titles | 8 | 32% |

The sample is small, so read the shares as directional only. I have not established how this group splits by country or seniority. What it does support is that the typical reviewer is a senior design leader, most likely in a sector where NDAs are routine, who has had to show confidential work of their own.

### How long they look

The widely repeated timing figures are weak. Use them to decide what goes first, not to justify a strategy.

| Claim | Value | Original source | Evidence quality |
|---|---|---|---|
| First scan | 6 to 8 s | UX University | No traceable study |
| Design leader review | 55 s | UX Tools | Secondary |
| Recruiter first scan | 30 to 60 s | UXPin | Secondary |
| Per case study | 2 to 3 min | Emily Backes | Single practitioner |
| Homepage / full review | 10 to 15 s / 2 to 3 min | Muz.li, via Fountain | Secondary |

These numbers get recycled from one blog post to the next, and Mantlr could not trace the 6-to-8-second figure to a peer-reviewed study. Volume is real, though: one design lead reviewed over 150 portfolios for a single Design Lead role. Recommended case study counts run from 1 to 3 (Penn State IST) up to 3 to 5 (UXfolio, Mantlr). One designer reportedly went from roughly 5% to 25% response rate after cutting to three outcome-focused case studies. That is a single anecdote, not evidence.

The practical consequence is that the public summary has to prove the core claim within the first screen, without the reader opening anything gated.

## The six dimensions and how to score each

Score four risk dimensions from 0 to 2 each, giving a risk total of 0 to 8. Then score proof value from 0 to 2 and record a permission status that overrides the rest. The risk total and proof value place the element. Permission can only widen what you may do, and only within the scope it grants.

| Dimension | What you check | Scores 2 when | How it lies |
|---|---|---|---|
| Coverage | The definition of confidential information | Clearly inside it | Broad wording hides a general-skill carve-out |
| Survival | The survival clause | In force, or no end date | "Years have passed" feels like expiry |
| Public record | Press, app stores, filings, company blog | Not public anywhere | Public launch, private internal numbers |
| Re-identification | Can a stranger reconstruct the secret? | Trivially | "+40%" beside a public base figure |
| Proof value | Does it prove what the role screens for? | Core proof for this role | Impressive but off-target |
| Permission | Written, scoped, authorized approver | Override, not scored | Verbal OK from a manager |

Here is what each dimension proves, and the one way it misleads:

- **Coverage** shows whether the element is legally in play at all. A 1 means the text is ambiguous. A clause written as broadly as the one in *Brown* may be unenforceable in California, but you should not stake your portfolio on winning that argument. Score it as covered.
- **Survival** shows whether the obligation still binds you. Score 0 only when the text names an end date that has passed.
- **Public record** shows the company has already disclosed the element. A 0 needs a source you can cite. A press release about a feature launch makes the feature public, not the metrics behind it.
- **Re-identification** shows whether removing names actually protects anything. An anonymised fintech dashboard with a distinctive layout, posted by someone whose profile names the employer, is not anonymous.
- **Proof value** shows whether the element is worth any risk. Score it against the specific posting, not your career. [Refolk](/candidates) scores how well you fit each posting, which gives you a quick read on which parts of a project carry proof for that role and which are just impressive.
- **Permission** is binary in practice: written and scoped from someone authorized to grant it, or not. Anything else scores as none.

### Verdict rules

Apply these in order. The thresholds are my own calibration, not an external standard.

1. **Permission first.** Written permission for public use: Publish, within its scope. Written permission for a limited audience: Gate, within its scope.
2. **Re-identification at 2 forces at least Recreate,** whatever the total.
3. **Risk 0 to 2:** Publish if proof value is 1 or 2. Cut if proof value is 0, because it costs reviewer time.
4. **Risk 3 to 5 is borderline:** Recreate, and if proof value is 2, send a permission request.
5. **Risk 6 to 8 with proof value 2:** Recreate the reasoning with invented data now, and request Gate permission for the real artefact.
6. **Risk 6 to 8 with proof value 0 or 1:** Cut.

#### Risk total against proof value

Horizontal axis runs from Low risk (0 to 2) to High risk (6 to 8). Vertical axis runs from Low proof value to High proof value.

| Quadrant | What it means |
| --- | --- |
| Publish | Lead the public case study with it |
| Recreate, then Gate | Rebuild with invented data and request written permission for the real artefact |
| Publish as context | One line of setup at most, or cut for space |
| Cut | Leave it out of portfolio, resume, and interview |

*High-proof, high-risk elements are recreated now and gated only once written permission arrives, while low-proof, high-risk elements are cut.*

> **Rule:** No raw covered material behind a password without written permission
>
> If coverage scores 2, survival scores 2, and you have no written permission, the element cannot be Gate. A recruiter is a third party, and I found no source saying a password changes that.

## Default verdicts by element type

The same kinds of element land in the same places most of the time. Use this table as a starting guess, then score the real element, because your agreement and the public record can move any row.

| Element | Usual verdict | Why |
|---|---|---|
| Employer or client name | Publish | Usually on your public profile already |
| Screens and UI | Recreate | Proof is in structure, not real data |
| Metrics | Publish directionally | Absolute figures often covered by policy |
| Code | Recreate or Cut | Usually squarely inside the definition |
| Architecture diagrams | Recreate | Rebuild at a level of abstraction |
| Customer names, roadmap items | Cut | High risk, low proof of your skill |

The employer row has one exception. Some client agreements bar naming the client at all. If yours does, describe the company by sector and size, for example "a payments company with a regulated product".

### Screens: recreate, never blur

Rebuild the screen with invented content and a neutral visual style that keeps the hierarchy, flow, and the decisions you made. Blurring is the most common mistake. A blurred screenshot still shows the layout, which is often the distinctive part, and it signals that you are showing something you should not.

### Metrics on the resume and in the portfolio

Whether you can share metrics from your old job on your resume depends on two checks: your agreement, and the company's disclosure policy. Then add a third check: can the number be reverse-engineered? Your options, from safest to riskiest:

- **Directional.** One practitioner argues that describing the direction of impact ("significantly improved", "reduced friction", "increased engagement") is enough. It is the safe default.
- **Relative, with no public base.** A percentage change on an internal measure that the company never publishes in absolute form.
- **Relative, with a public base.** A percentage next to a figure in a filing or press release reveals the absolute number. Treat it like an absolute figure.
- **Absolute.** Publish only if the company has published it or you have written permission.

Also check timing. The DraftKings posts discussed growth before the company had released its results. A figure about a period whose results were not yet public carries more risk than the same figure about a year already reported.

### Process and decisions

Your method, your reasoning, the trade-offs you weighed, and what you would do differently are the strongest candidates for Publish. The *Brown* court protected an employee's right to keep competing, and in my reading, general method and judgement sit on that side of the line. That reading is mine, not a court's. If your clause explicitly covers internal processes, score coverage honestly and recreate the process with a generic example.

## How to score one project, step by step

Scoring one project takes roughly half a day of reading and scoring, plus however long permission and recreation take. Do the reading before the scoring, because the verdicts depend entirely on the text.

#### Score one confidential project

1. **Collect every agreement** - Gather the offer letter, confidentiality agreement, contractor NDA, master services agreement, statement of work, and severance agreement, then record each one's definition, duration, portfolio clause, and return-of-materials clause. About an hour.
2. **Check the survival clause** - Record each agreement as in force unless its text names an end date that has passed. About 15 minutes.
3. **List the elements one row each** - Give employer name, screens, metrics, code, diagrams, customer names, roadmap items, and process their own rows. About 30 minutes per project.
4. **Check the public record** - Search press releases, app store listings, filings, and the company blog, and note a source for anything already public. About an hour.
5. **Score and assign verdicts** - Score the four risk dimensions and proof value, record permission status, and apply the verdict rules in order. About an hour.
6. **Request permission in writing** - Send a scoped written request for every Gate or borderline element to your former manager or current team lead, and to legal or communications where policy names them. Set a follow-up date and treat silence as no.
7. **Recreate and write the resume line** - Rebuild Recreate elements with invented data and neutral branding, then write one resume line from Publish-level facts only. Days to weeks.
8. **Label and run a consistency pass** - Mark NDA projects in the portfolio, note any permission you hold, and check that every resume fact matches its portfolio verdict.

Sources disagree on step order. UX Playbook puts the permission request first. Other practitioners put value analysis first and only ask about the elements that matter. I put scoring before asking, because a request that names six specific elements gets a clearer answer than "can I show my work".

Keep the scoring on one sheet per project:

**Element scoring sheet (one row per element)**

```
Element | Agreement clause | Coverage 0-2 | Survival 0-2 | Public 0-2 | Source if public | Re-ID 0-2 | Risk total | Proof value 0-2 | Permission (none / written-public / written-limited) | Verdict | Next action
Employer name | Offer letter s.4 | 0 | 2 | 0 | Company blog launch post | 0 | 2 | 1 | none | Publish | Use in resume line
Checkout redesign screens | Confidentiality agmt s.1 | 2 | 2 | 2 | | 1 | 7 | 2 | none | Recreate, request Gate | Rebuild with invented data; send request
Conversion change | Disclosure policy | 2 | 2 | 2 | | 2 | 8 | 2 | none | Recreate | State direction only
Enterprise customer names | Confidentiality agmt s.1 | 2 | 2 | 2 | | 2 | 8 | 0 | none | Cut | Remove from all materials
```

*Copy into a spreadsheet; one sheet per project, one row per element, and fill the Source column before scoring Public.*

## How to ask for permission in writing

Ask in writing, list the elements by name, say which audience each one is for, and send the request to someone with authority to say yes. Practitioners agree on a written scope. One guide adds that you should be clear about which work you want to show and why.

Who to send it to:

1. **Your former manager, or whoever leads the team now.** They know what is sensitive.
2. **Legal or communications,** where the company's policy names them as approver. At DraftKings, the policy required prior written approval from the communications team, so a manager's OK alone would not have met the policy.

No typical response time is established publicly. Set your own date, follow up once, and treat no answer as no. Keep building the Recreate versions while you wait.

**Scoped permission request for NDA-covered portfolio elements**

```
Subject: Permission request: showing [project name] work in my portfolio

Hi [name],

I am updating my portfolio and resume and want to stay inside my confidentiality obligations to [company]. I would like written permission for the specific items below. Everything not listed stays out.

1. [Element, e.g. three checkout flow screens] - shown to [audience: public page / password-protected page shared with hiring teams / live walkthrough in interviews only]
2. [Element, e.g. the direction of change in checkout completion, no figures] - shown [public / resume]
3. [Element] - shown [audience]

For each item I will remove customer names, internal figures, and roadmap references. I can send you the exact pages before anything goes live.

If someone else approves external use of company material, such as communications or legal, could you point me to them?

I would appreciate a reply by [date]. If I do not hear back, I will treat the answer as no and keep these items out.

Thanks,
[your name]
```

*Name every element and audience exactly; delete rows you are not asking about.*

Save every reply. A reply that approves some items and not others is still useful: those items become Publish or Gate within the scope granted, and the rest keep their scored verdict.

## How this goes wrong

Most failures come from a signal that feels like permission or safety when it is neither. Each item below gives the false signal and the check that catches it.

1. **The password feels like a cure.** A gated page with raw screens feels private. Check: does the agreement forbid disclosure to any third party? If it does, a recruiter is a third party. Practitioner sources list password pages, expiring links, and live walkthroughs as ways to show real work, but the same sources set the rule that NDA work can be shown only with written permission, after the NDA expires, or when the NDA does not cover it. A live walkthrough of real covered material is disclosure as well.
2. **"Time has passed" is read as expiry.** UX Playbook says never to assume it is okay to share work just because time has passed. Check the survival clause. Most agreements are perpetual.
3. ***Brown v. TGS* is read as "NDAs don't apply in California".** The case voided an overbroad clause. A properly drawn one remains enforceable. Check whether your clause carves out general skill, and score coverage on the text you actually have.
4. **Leaning on *McLaren Macomb*.** It concerns severance agreements and likely does not reach supervisors, and the memo that expanded it was rescinded. Check whether you were a supervisor and whether the clause is in a severance agreement at all.
5. **Blurring screenshots.** Blurred images still show layout, and the layout is often the identifying part. Check: recreate instead.
6. **Relative metrics that can be reverse-engineered.** A "+40%" next to a publicly known base figure reveals the absolute number. Check every percentage against the company's filings and press releases, and check whether it covers a period whose results were not yet public.
7. **The resume and portfolio disagree.** The resume states a figure that the portfolio says is under NDA. A reviewer reads that as either a breach or an invented number. Check: one consistency pass across both, fact by fact.
8. **Permission given verbally, or by someone without authority.** A manager's "sure, go ahead" in a call is not written and may not be valid where policy names communications as the approver. Check the company policy, and get the answer in writing.

> **Watch out:** Anonymising is not the same as protecting
>
> Removing the logo and client name does little if the layout, the metric, and your public employment history together identify the company. Score re-identification on what a stranger could work out from your whole profile, not from the image alone.

There is one more failure in the other direction: cutting everything. With 73% of computer and mathematical workers reporting an NDA, a reviewer expects confidential work and can read a recreated case study. A portfolio of student projects in its place tells them you could not find a way to show your work.

## Keeping the public summary, gated deep dive, and resume line consistent

One project gives you several outputs at different levels of exposure, and each fact may appear only at its verdict's level or deeper. The resume line is the most widely read and must be the most conservative.

#### Disclosure layers for one confidential project

1. **Resume line** - One sentence of Publish-level facts and directional or permitted figures
2. **Public case study** - Published and recreated elements, with the project labelled as under NDA
3. **Gated deep dive** - Real artefacts with written limited-audience permission, behind a password or expiring link
4. **Live walkthrough** - Recreations discussed in interview; real material only within written permission
5. **Never shown** - Cut elements such as customer names, roadmap items, and nonpublic financials

*Each fact may appear at its verdict's layer or deeper, never in a wider layer, so the resume line carries only Publish-level facts.*

Labelling matters. IxDF advises stating clearly which projects are NDA-protected and, wherever you disclose details, stating that you have explicit permission. A short line at the top of the case study does both jobs: it explains why the data is invented and shows the reviewer you take confidentiality seriously, which is part of what they are hiring for.

When you tailor the resume for each posting, the safe wording drifts unless you lock it. Refolk drafts the resume from your own history and tailors it to every posting you apply to. Give it the approved resume line and the directional metric wording for each confidential project, so that every tailored version stays at Publish level.

### When to re-score

Re-score a project when any of these change:

- The company publishes something new about it, such as a launch post, a filing, or a talk. Public-record scores can drop.
- A permission reply arrives, or a permission is withdrawn.
- You sign a new agreement, including a severance agreement.
- You target a different role. Proof value is scored per posting, so a different role can flip a verdict between Publish and Cut.

#### Before sending the portfolio and resume

- [ ] Every agreement for this project is collected, and each one's definition, survival term, portfolio clause, and return-of-materials clause are recorded.
- [ ] Every element has its own row with all six dimensions scored and one verdict.
- [ ] Every element scored 0 on public record has a cited public source.
- [ ] No element with coverage 2, survival 2, and no written permission appears in raw form anywhere, including behind a password.
- [ ] No screenshot is blurred; every Recreate element uses invented data and neutral branding.
- [ ] Every percentage has been checked against public filings and press releases for a reconstructable base figure.
- [ ] Every Gate element has a written, scoped permission from an authorized approver on file.
- [ ] The portfolio labels which projects are under NDA and notes any explicit permission.
- [ ] Every figure and name on the resume appears at the same or a deeper layer in the portfolio, never a shallower one.
- [ ] The password for any gated page is written into the application itself.

## Frequently asked questions

### Can I put confidential work in my portfolio if I password-protect it?

Only if you have written permission that covers showing it to that audience. I found no legal source saying a password changes whether something counts as disclosure. If your agreement bars disclosure to any third party, a recruiter is a third party. Practitioner guides do recommend password pages, but the same guides also say NDA work can be shown only with written permission, after the NDA expires, or when the NDA does not cover it.

### Can I share metrics from my old job on my resume?

Yes, but only in a form your agreement and the company's disclosure policy allow. Ordinary employees are mostly bound by company policy rather than Regulation FD. Directional phrasing like "reduced friction" or "increased engagement" is the safe default. Before using a percentage, check that it cannot be combined with a publicly known base figure to reveal the absolute number, and that it does not touch results the company had not yet released.

### How do I build a portfolio when all my work is under NDA?

Score each element separately instead of deciding at project level. Your process, your reasoning, and anything the company has already published usually survive. Screens and diagrams can be recreated with invented data. Real artefacts can be gated, but only under written permission. Most projects that look like all-or-nothing still give you one public summary, one gated deep dive, and one resume line.

### Does my NDA expire after a few years?

Usually not. Research by Hrdy and Seaman found that almost all employee confidentiality contracts last indefinitely and have no geographic limits. Open the agreement and find the survival clause, which says how long the obligation lasts after you leave. If it gives no end date, treat the agreement as in force. One practitioner guide puts it plainly: never assume it is okay to share work just because time has passed.

### Who should I ask for permission to show NDA work?

Start with your former manager or whoever leads the team now, then go to legal or communications if company policy names them as the approver. At public companies, communications can be the only valid approver: DraftKings' policy required prior written approval from its communications team. Get the answer in writing, and list each element by name so the permission has a clear scope.

### Do recruiters actually open password-protected portfolio pages?

Nobody has publicly established how many reviewers open a gated page and how many give up at the password prompt. Some hiring teams plan for gated work: Etsy's product design portfolio guide reminds candidates to share the password if their most relevant work is protected. Put the password in the application itself, and make sure the public summary proves enough on its own in case nobody opens the gated page.

---

*From the Refolk guide library. I revise these guides rather than replacing them, so the current version is always at https://www.refolk.ai/candidates/guides/nda-case-study-element-score*