Drive and group access control

Define your Google Workspace drives, folders and groups, grant access through groups and audit Google against that setup on a schedule.

Groups4

Role

Access

PendingManagedIn sync

Workspace governance

northfield.example · Connected

Audit nowApply to Google

You have changes not yet applied to Google Workspace.

TopologyState

Scheduled audits · every 24 hoursLast audited · 24h ago

Checks

6 policies

G0Direct user access—
LB
Lena Brandt · Viewer on Legal
Replace with a group grant, then remove it
G1People directly in access groups—
G2Naming integrity—
G3External access (airlock)—
G4Drive capacity—
Drive hardening—

Unmanaged resources2

Live in Google, outside the topology

Findings are reported for review

Google Workspace

northfield.example· Connected

Import from Google

Drives and groupsNothing yet

You have changes not yet applied to Google Workspace.2 governed · 2 not managed

Set up drives and groups

Import what already exists or define it from scratch, and every audit compares what you intended with what Google reports.

ChecksLatest audit

Omar Haddad

Direct member of acc-fund-ii-edit

1Add to investment-team

2Remove direct memberAfter step 1

This changes Google immediately. Review the person and group first.

Omar →investment-team → acc-fund-ii-edit

Each check reports drift for review, folder templates repeat the structure you approve, and Slack membership is reconciled with the same directory.

Google changes only when a manager applies your edits, and your intended setup stays apart from what Google reports.

Every person needs an explicit grant: The organization needs the Workspace governance rollout, and each person an explicit grant. Organization admins and platform administrators get no bypass, and guests cannot hold one.
Viewer, Manager and Admin roles: Viewers read topology, findings and inventory. Managers edit, apply, audit and enforce Slack policy. Admins also manage connections, schedules and mailbox delegates.
Revokes only permissions it created: Provisioning touches only the resources it governs and revokes only the permissions it created, which are recorded as managed. Removing a record from the topology never deletes the drive or group in Google.
Audits on a schedule: Run an audit on demand or every 6, 12, 24 or 48 hours. A failed provider read reports Error and, where it can, keeps earlier evidence rather than clearing it.
Its own service account: Google access runs through its own service account with domain-wide delegation. A super admin authorizes the exact scope set and the admin identity it acts as.
Grant mailbox delegates one at a time: Admins grant or revoke a delegate within the same Google organization as a one-off, logged action. Delegation is never provisioned or checked for drift.

Products that run on the same login and record.

Audit every governed drive and group against Google on demand or every 6, 12, 24 or 48 hours.