63 Travel-mode accounts

For a border crossing or a trip into a hostile jurisdiction, the traveller carries a sanitised identity: a travel account or travel OU with no admin roles, no Vault, no sensitive shared drives, a geo-restricted access policy and a short session. Access is granted by group, so moving the person between groups is the whole switch. The primary identity is suspended for the duration where the trip allows it, and its sessions and tokens are revoked on return before membership is restored.

Caveats

Suspension does not kill live sessions or issued OAuth tokens¹
The runbook must be executable by someone other than the traveller²

Setup steps

Pre-create a travel identity (or a travel OU — organizational unit) whose access is a strict subset: no Vault, no admin, no sensitive shared drives.

Travel OU: Context-Aware Access geo policy (Enterprise Standard+, Education Standard+, Frontline Standard+, Enterprise Essentials Plus and Cloud Identity Premium; silently ignored on other editions) + short session length + no admin roles

Protect your business with Context-Aware Access ↗ Set session length for Google services ↗
open ↗
https://admin.google.com/ac/groups · captured 2026-07-15
Directory › Groups
On departure, swap the traveller out of the sensitive groups and into the travel group — access is by group, so the swap is the whole control.
```
gam update group sensitive-team remove member user@…
gam update group travel add member user@…
```
Add or invite users to a group ↗ Remove or ban users from a group ↗
open ↗
https://admin.google.com/ac/users · captured 2026-07-15
Directory › Users
Suspend the primary identity for the duration if the traveller does not need it, and restore on return.
```
gam update user user@… suspended on|off
```
Suspend a user temporarily ↗ Restore a suspended user ↗
On return, force re-auth and revoke all existing sessions/tokens before restoring group membership.
```
gam user user@… signout
gam user user@… deprovision   # revokes tokens, app passwords and backup codes
```
Sign a user out of a managed Google Account ↗

Ongoing maintenance

automatable: script Per trip: provision the travel account before departure and destroy/rotate it on return.
requires a human Per trip: brief the traveller and confirm the primary account lock.

How to verify

Before a trip: confirm the travel account holds only the trip’s data, sits in the travel OU with its tighter CAA level, and the traveller’s primary account is suspended or locked for the duration.

v0.1.3Prevent policy #25 · #14, #30 ↗