Google file access setup

Use this page to collect the values you put into the file access control for Google Drive, Docs, Sheets and Slides. That page explains the rule. This one covers the ids and the scopes.

Find a label id

Drive labels are created and published in the Google Workspace Admin console, in the Drive labels manager. PolicyArc does not create them.

A label source takes the bare label id. Google returns a label's name as labels/<id>. Use the part after labels/. For labels/sKFCys64ExampleApprovedId, the value is sKFCys64ExampleApprovedId.

To list your labels with the Drive Labels API, call it with a Google access token for an account that can read them.

curl -H "Authorization: Bearer $GOOGLE_ACCESS_TOKEN" \
  "https://drivelabels.googleapis.com/v2/labels?view=LABEL_VIEW_FULL"

For Google Drive, the gateway asks Drive only for label ids made of letters, digits, _ and -. It drops any other value with a warning, so a label name such as IDENTOS Internal never matches.

Find a folder or shared drive id

A location source takes folder ids and shared drive ids. Both are matched the same way.

• A folder id is the last part of the folder's URL in Drive, https://drive.google.com/drive/folders/<id>.
• A shared drive id is the last part of the shared drive's URL in Drive, which has the same shape.
• With the Drive API, a file's parents field holds its folder ids, and its driveId field holds its shared drive id. The gateway reads these two fields.

Locations match by id. Drive has no paths to match on.

Check the scopes

The gateway looks up labels and parents with the user's own Google token, not through a connector's tools. That token needs these scopes.

Scope	Used for
https://www.googleapis.com/auth/drive.labels.readonly	Reading a file's labels
https://www.googleapis.com/auth/drive.metadata.readonly	Reading a file's parents and shared drive id

The table lists only the scopes the lookups use. Each connector's manifest requests more, and every one asks for drive.labels as well as drive.labels.readonly.

Connector	Google scopes it requests, besides userinfo.email
Google Drive	drive.readonly, drive.file, drive.labels.readonly, drive.labels
Google Docs	documents, drive.metadata.readonly, drive.labels.readonly, drive.labels
Google Sheets	spreadsheets, drive.metadata.readonly, drive.labels.readonly, drive.labels
Google Slides	presentations, drive.metadata.readonly, drive.labels.readonly, drive.labels

drive.readonly covers the parents lookup for Drive. Docs, Sheets and Slides each request drive.metadata.readonly, so any one of them is enough. A user who signed in to Google before the connector was installed has a token without these scopes. If the lookup fails, the call is denied. See Fail-closed rules. To add new scopes to the identity provider on a running environment, sync the connector as in Keep connector tools current, and have users sign in again.

A worked example for Google Docs

This row lets get_document return a document that has the approved label or sits directly in the approved folder. It denies a document in the HR folder, whatever else is true.

curl -fsS -X PUT "$POLICYARC_URL/admin/api/policy-data/by-key?dataKey=pbac.operator.controls.file_access" \
  -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "dataKey": "pbac.operator.controls.file_access",
    "payload": {
      "sources": {
        "drive-labels": {"type": "label", "required": ["sKFCys64ExampleApprovedId"], "blocked": []},
        "drive-location": {"type": "location", "required": ["1AbcApprovedFolderId"], "blocked": ["1XyzHRFolderId"]}
      },
      "governed": {
        "urn:connector:identos:google-docs": ["drive-labels", "drive-location"]
      }
    }
  }'

Docs is a resolve-path connector. Before each get_document, the gateway reads the document's labels and parents and applies the rule. A denied document gets HTTP 403, and the audit reason is file_access:blocked_match or file_access:not_in_required.

We have not run this example against Google for this page.