Workspace governance overview

Workspace governance is the gated Infra One workspace for managing Google Workspace drives, folders, groups, and access from one governed topology. It can compare that intended setup with Google, apply approved changes, audit drift, manage reusable folder templates, reconcile Slack membership, and perform one-off mailbox delegation.

The service does not open merely because someone is an organization admin. The organization needs the workspace_governance rollout flag, and the person needs an explicit Workspace governance Viewer, Manager, or Admin grant for that organization.

What you can govern

Area	What it does
Overview	Shows connection state, pending local changes, topology counts, audit health, unmanaged resources, and the setup checklist.
Drives	Defines governed shared drives, top-level folders, hardening rules, airlock status, and group-based access grants.
Groups	Defines role, access, external, and distribution groups and manages their live membership.
Users	Reads the Google directory and adds users to provisioned role groups.
Folder templates	Stores reusable folder trees and attaches them to managed folders as direct children or per-year structures.
Checks	Explains the six governance checks and shows the latest findings.
Slack channels	Audits channel naming and membership policies and can auto-add missing members when that policy is enabled.
Slack members	Reconciles Slack accounts with the Google directory and highlights guest-expiration problems.
Settings	Connects Google Workspace and Slack, schedules audits, changes the Google admin identity, and opens mailbox delegation.

Topology, provisioning, and audit

Workspace governance separates intended state from observed provider state:

1. Import from Google reads live drives, folders, and groups into the local topology, or a manager defines them directly.
2. Local edits remain pending until a manager selects Apply to Google.
3. Provisioning creates or adopts governed drives, folders, and groups, applies group settings and access grants, and records the permissions it manages.
4. Audit now compares the governed topology with Google and records In sync, Drifted, Missing, or Error results.
5. Scheduled audits repeat that comparison at the configured interval.

Provisioning operates only on governed resources. It does not reconcile every observed resource, and it does not delete arbitrary permissions it did not create. When a governed grant is removed, it can revoke the corresponding permission only when that permission was previously recorded as managed by Workspace governance.

An audit error is not treated as a clean result. When a provider read is unavailable, the worker preserves prior evidence where it can and reports the failure.

The six checks

The Checks page describes six current policy checks:

1. Direct user access · G0 — governed drive roots and managed folders should be assigned through groups rather than directly to individuals.
2. People directly in access groups · G1 — access groups should contain role groups, not individual users.
3. Naming integrity · G2 — access and external groups must use the configured prefixes.
4. External access (airlock) · G3 — external groups can receive access only through an airlock drive that permits users outside the workspace domain.
5. Drive capacity · G4 — Google limits a drive to 100 groups, 600 members, and 50,000 individuals; large indirect memberships can also affect whether the drive appears automatically.
6. Drive hardening — governed drives are checked for restriction drift, including domain, membership, sharing, and administrator controls.

The checks report drift; they do not all repair it automatically. A manager can remove a direct person from an access group from the finding, which changes Google. Review the affected group and person before using that action.

External-provider boundaries

• The Google connection uses a dedicated service account with domain-wide delegation. A super admin authorizes its exact scope set and supplies the admin identity it impersonates.
• The Google Workspace Marketplace app is currently unpublished, so the available setup path is the manual domain-wide delegation flow shown in Settings.
• Slack uses its own app and OAuth connection. Audits are read-only. Membership enforcement only auto-adds missing people for policies with Auto-add missing members enabled; Exclusive findings never remove extra members automatically.
• Mailbox delegation uses two optional Gmail scopes. It is separate from topology provisioning and drift checks: each grant or revoke is a one-off Admin action written to the log.

Start with these tasks

• Set up Workspace governance
• Manage topology, templates, Slack, and mailboxes
• Reference Workspace governance permissions and states
• Troubleshoot Workspace governance