29 Shared-drive architecture

Shared drives own their files, so data survives a departure instead of being stranded in an ex-employee's My Drive. This control decides who may create a drive at all, sets the org-wide defaults every new drive inherits (external access, non-member access, download/print/copy for viewers), and audits the drives that exist. Membership is by group, never by individual — that is what makes access recertification (№41) a review of about twenty groups rather than a crawl over thousands of ACLs.

Documentation: Set up shared drives for your organization ↗

Caveats

A drive manager can override the org defaults unless you explicitly turn the override off¹
Orphaned drives, where every manager has departed, are invisible in the normal Drive UI²
Files in a shared drive are governed by drive-level DLP and label policy, not by per-user policy³

Setup steps

open ↗
https://admin.google.com/ac/managedsettings/55656082996/sharing · captured 2026-07-15
Apps › Google Workspace › Drive and Docs › Sharing settings › Shared drive creation
Decide who may mint a shared drive. Uncontrolled creation is how the data topology stops being knowable.

Prevent users in <OU> from creating new shared drives = On for general staff; Off for a small set of drive owners

Allow users to create shared drives ↗
Apps › Google Workspace › Drive and Docs › Sharing settings › Shared drive creation
Set the org-wide defaults that every new shared drive inherits — these are the settings a drive manager can otherwise loosen per-drive.

Allow members with manager access to override the settings below = Off; Allow users outside <organization> to access files in shared drives = Off; Allow people who aren't shared drive members to be added to files = Off; Allow viewers and commenters to download, print, copy = Off; Allow content managers to share folders = Off

Manage shared drives as an admin ↗
open ↗
https://admin.google.com/ac/list/shareddrives · captured 2026-07-15
Apps › Google Workspace › Drive and Docs › Manage shared drives
Enumerate existing shared drives and audit each against the register: name, owner group, member count, external-member count, sensitivity tier.

Per drive: Manage members → confirm membership is by Group, never by individual

Manage shared drives as an admin ↗
Apps › Google Workspace › Drive and Docs › Manage shared drives
For each drive holding crown-jewel data, apply the restrictive per-drive settings and record the drive in the asset register (feeds №5 account-inventory and №44 vault-account-custody).

Per drive: external access
Off
sharing with non-members
Off
download/print/copy for viewers
Off

Manage shared drives as an admin ↗

Ongoing maintenance

automatable: script Quarterly: review shared-drive membership as part of the №41 recertification cycle.

How to verify

Enumerate shared drives and their settings — external members, download/copy restrictions, and managers should match the architecture.
```
gam print shareddrives fields id,name,restrictions
```

v0.0.3Prevent policy #15 · #10 ↗