# 29 Shared-drive architecture

> v0.0.3 · role: Prevent · [policy: #15 · #10](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Shared drives own their files, so data survives a departure instead of being stranded in an ex-employee's My Drive. This control decides who may create a drive at all, sets the org-wide defaults every new drive inherits (external access, non-member access, download/print/copy for viewers), and audits the drives that exist. Membership is by group, never by individual — that is what makes access recertification ([№41](access-recertification.md)) a review of about twenty groups rather than a crawl over thousands of ACLs.

Documentation: [Set up shared drives for your organization](https://knowledge.workspace.google.com/admin/drive/set-up-shared-drives-for-your-organization)

## Caveats

- A drive manager can override the org defaults unless you explicitly turn the override off — most tenants leave it on and then wonder why the defaults did nothing.
- Orphaned drives, where every manager has departed, are invisible in the normal Drive UI — this admin screen is the only place you will find them, and they are a standing exposure.
- Files in a shared drive are governed by drive-level DLP and label policy, not by per-user policy — the departure-proofing has a governance consequence you have to plan for.

## Setup steps

1. Decide who may mint a shared drive. Uncontrolled creation is how the data topology stops being knowable. — `Apps › Google Workspace › Drive and Docs › Sharing settings › Shared drive creation`

   Prevent users in <OU> from creating new shared drives = On for general staff; Off for a small set of drive owners

   docs: [Allow users to create shared drives](https://knowledge.workspace.google.com/admin/drive/allow-users-to-create-shared-drives)

2. Set the org-wide defaults that every new shared drive inherits — these are the settings a drive manager can otherwise loosen per-drive. — `Apps › Google Workspace › Drive and Docs › Sharing settings › Shared drive creation`

   Allow members with manager access to override the settings below = Off; Allow users outside <organization> to access files in shared drives = Off; Allow people who aren't shared drive members to be added to files = Off; Allow viewers and commenters to download, print, copy = Off; Allow content managers to share folders = Off

   docs: [Manage shared drives as an admin](https://knowledge.workspace.google.com/admin/drive/manage-shared-drives-as-an-admin)

3. Enumerate existing shared drives and audit each against the register: name, owner group, member count, external-member count, sensitivity tier. — `Apps › Google Workspace › Drive and Docs › Manage shared drives`

   Per drive: Manage members → confirm membership is by Group, never by individual

   docs: [Manage shared drives as an admin](https://knowledge.workspace.google.com/admin/drive/manage-shared-drives-as-an-admin)

4. For each drive holding crown-jewel data, apply the restrictive per-drive settings and record the drive in the asset register (feeds [№5](account-inventory.md) account-inventory and [№44](vault-account-custody.md) vault-account-custody). — `Apps › Google Workspace › Drive and Docs › Manage shared drives`

   - **Per drive: external access** = Off
   - **sharing with non-members** = Off
   - **download/print/copy for viewers** = Off

   docs: [Manage shared drives as an admin](https://knowledge.workspace.google.com/admin/drive/manage-shared-drives-as-an-admin)

## Ongoing maintenance

- **[automatable: script]** Quarterly: review shared-drive membership as part of the [№41](access-recertification.md) recertification cycle.

## How to verify

1. Enumerate shared drives and their settings — external members, download/copy restrictions, and managers should match the architecture.

   ```
   gam print shareddrives fields id,name,restrictions
   ```

## Settings screens

- Apps > Google Workspace > Drive and Docs > Sharing settings > Shared drive creation
  - console: https://admin.google.com/ac/managedsettings/55656082996/sharing
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/55656082996/sharing.png
- Apps > Google Workspace > Drive and Docs > Manage shared drives
  - console: https://admin.google.com/ac/list/shareddrives
  - screenshot: ../screenshots/admin.google.com/ac/list/shareddrives.png