46 Reading-room enclave (SCIF port, incl. data-copy minimization)

An enclave OU and shared drive in which approved readers can view crown-jewel documents and do nothing else with them: no external sharing, no non-member access, and no download, copy or print for viewers and commenters — the data-copy minimization half of the control. Enclave content carries a Restricted label so a DLP rule can block and alert on any attempt to share, download or attach it, and Drive access for the enclave OU is bound to a Context-Aware Access level requiring a managed device on the reading-room network.

Caveats

Selecting an access level puts it in Monitor mode by default¹
Download/copy/print restriction is not DRM²
Enterprise Standard+, Education Standard+, Frontline Standard+ and Enterprise Essentials Plus for…³

Setup steps

open ↗
https://admin.google.com/ac/managedsettings/55656082996/sharing · captured 2026-07-15
Apps › Google Workspace › Drive and Docs › Sharing settings
Put the enclave members in their own OU (organizational unit) and take external sharing away from it entirely — the enclave's whole premise is that content cannot leave.

Sharing outside the organisation
OFF
Allow users to receive files from outside
OFF

Manage external sharing for your organization ↗
open ↗
https://admin.google.com/ac/list/shareddrives · captured 2026-07-15
Apps › Google Workspace › Drive and Docs › Manage shared drives
Create the enclave shared drive and strip the copy/download/print capability from viewers and commenters — this is the data-copy minimization half of the control.

Allow people who aren't shared drive members to be added to files = OFF; Allow viewers and commenters to download, print, and copy files = OFF; Allow users outside your organization to access files in shared drives = OFF

Manage shared drives as an admin ↗
open ↗
https://admin.google.com/ac/dc/labels · captured 2026-07-15
Security › Access and data control › Label manager
Apply the enclave label to the drive's contents so DLP has something to key on.

Create a label (e.g. 'Sensitivity') with a 'Restricted (enclave)' option in Label manager and apply it

Create classification labels for your organization ↗ Get started as a classification labels admin ↗
open ↗
https://admin.google.com/ac/dp · captured 2026-07-15
Security › Access and data control › Data protection
Add the egress rule: any share, download, or Chat/Gmail attachment of enclave-labelled content is blocked and alerted.

Condition
Label = Restricted
Action
Block
Alert
High severity

Create DLP for Drive rules and custom content detectors ↗ About DLP ↗
open ↗
https://admin.google.com/ac/security/context-aware · captured 2026-07-15
Security › Access and data control › Context-Aware Access
Bind Drive access for the enclave OU to the reading-room access level (managed device + reading-room IP), then check the Active box to take it out of Monitor mode.

App
Drive
Access level
reading-room
Mode
Active (not Monitor)

Assign Context-Aware Access levels to apps ↗ Protect your business with Context-Aware Access ↗

Ongoing maintenance

requires a human Quarterly: review the enclave access list and expire finished engagements.

How to verify

As an authorised test user inside the enclave, attempt to download, print, and copy from a protected document — every path must be refused; then attempt access from outside the enclave context — it must be denied entirely.

v0.0.3Preventedition Ent Std+ policy #28 · #15, #26 ↗