Plan a Workspace AI access policy

Use this page to turn the file access control into your organization's policy for Google Workspace. That page explains the rule. This one helps the security or IT team decide what to approve and what to block, and ends with the data row to write.

The three levers

Lever	Set by	Reaches
Shared drive, by drive id	The security team, in the control's data row	Every file in the drive, at any depth
Folder, by folder id	The security team, in the control's data row	The folder and the files directly inside it. Not sub-folders.
Label, by label id	The Workspace admin defines it. It is applied to files in Drive.	One file, wherever it is

Two properties of the rule decide how they combine.

• Approvals add up. A file is reachable if it is in an approved shared drive, or in an approved folder, or has an approved label.
• A block always wins. A restricted label or a blocked folder or drive keeps the file out, whatever approvals it also has.

Folder and drive approvals live in the data row, so only someone with the Admin API or the Admin Portal can change them. A label works one file at a time, without moving or re-sharing the file.

We did not run this policy against Google Workspace for this page. The rule and the audit reasons below come from the code and the control's tests.

Decide

1. Which content is AI-usable by default. A dedicated shared drive is the simplest choice, because it covers nested folders and its membership is managed in Drive.
2. Which content must never be reachable. Pick the restricted labels, such as Confidential, and the blocked drives or folders, such as an HR drive.
3. How people opt a file in. Pick one approved label, such as AI-Available.
4. Which connectors to govern. Labels and locations apply to Google Drive, Docs, Sheets and Slides. Confluence supports labels. A connector you leave out of governed is not governed at all.
5. What files an agent creates get. Set a default label, one of the approved ones, so the agent can read back what it wrote.

Roll it out

1. Create the labels in the Google Admin console and collect the label, folder and drive ids. Google file access setup shows how.
2. Start with one connector, one approved drive or label, and one restricted label. Check that an approved file comes back and a restricted one does not.
3. Tell people about the approved and restricted labels before you widen the policy.
4. Add the remaining drives, folders and connectors.
5. When a file is withheld, look at the gateway audit row. For Docs, Sheets, Slides and Confluence the reason names the rule, file_access:blocked_match or file_access:not_in_required. For Drive, a file missing from a list leaves no reason, and a denied single file reports not_permitted.

Write the row

Put the ids you collected into the pbac.operator.controls.file_access row. The operator config schema shows the write call.

{
  "sources": {
    "org-labels": {
      "type": "label",
      "required": ["aiAvailableLabelId"],
      "blocked": ["confidentialLabelId"],
      "default": {"label_id": "aiAvailableLabelId"}
    },
    "org-location": {
      "type": "location",
      "required": ["0AApprovedSharedDriveId"],
      "blocked": ["0AHrSharedDriveId"]
    }
  },
  "governed": {
    "urn:connector:identos:google-drive": ["org-labels", "org-location"],
    "urn:connector:identos:google-docs": ["org-labels", "org-location"],
    "urn:connector:identos:google-sheets": ["org-labels", "org-location"],
    "urn:connector:identos:google-slides": ["org-labels", "org-location"]
  }
}

Limits to plan around

• A folder approval covers one level. Use a shared drive for a whole tree.
• Locations match by id only. Drive has no paths to match.
• A label matches by its id. To approve and block with labels, use two different labels.
• The control governs what an agent gets through the gateway. It does not change who can open a file in Drive.