Workspace governance permissions and states
Reference Workspace governance routes, rollout and grant checks, provider boundaries, resource states, policy checks, and lifecycle effects.
Workspace governance is an authenticated organization service with two independent access gates: the workspace_governance rollout flag and an explicit Workspace governance grant on the current organization membership.
Routes
All customer routes use workspace-governance.infra.one.
| Route | Surface |
|---|---|
/:organization-slug | Overview and setup progress |
/:organization-slug/drives | Governed and observed drives, folders, and access grants |
/:organization-slug/groups | Group definitions and live group membership |
/:organization-slug/users | Live Google directory and role-group membership |
/:organization-slug/folder-templates | Folder templates and attachments |
/:organization-slug/checks | Six policy checks and findings |
/:organization-slug/slack/channels | Slack inventory and membership policies |
/:organization-slug/slack/members | Slack members, guests, and reconciliation findings |
/:organization-slug/settings | Google, Slack, schedules, roles, and mailbox entry point |
/:organization-slug/settings/mailbox-delegation | Admin-only mailbox delegate lookup, grant, and revoke |
/:organization-slug/slack/oauth/connect | Starts the Admin-only Slack connection or reconnection flow |
/slack/oauth/callback | Slack OAuth callback |
The rollout flag is organization-scoped, with the supported user-level rollout exception. If the flag is absent, the access plug responds as not found. A grant does not carry from one organization to another.
Grant ladder
Being an organization admin is not enough and does not grant a bypass. Platform administrators also receive no bypass. A guest membership cannot receive a Workspace governance grant.
| Grant | Capabilities | Current scope |
|---|---|---|
| Viewer | view_workspace_governance | Read topology, audit findings, folder templates, users, and Slack inventory. Mutating controls remain disabled with a reason. |
| Manager | Viewer plus manage_workspace_governance | Create and remove topology records, apply provisioning, run audits, manage templates and group membership, and enforce Slack policies. |
| Admin | Manager plus manage_workspace_governance_connection and manage_mailbox_delegation | Connect, test, change, or disconnect Google and Slack; manage schedules and Slack connection policy; grant and revoke mailbox delegates. |
Admin is cumulative: it carries every Manager and Viewer capability. A Manager cannot connect or disconnect providers, change the Google admin identity, toggle connection-owned schedules, or open mailbox delegation.
Topology and resource states
| State or label | Meaning |
|---|---|
| Observed / Not managed | Imported or discovered provider resource that is visible but not reconciled by provisioning. |
| Governed / Managed | Resource belongs to the intended topology and can be reconciled. |
| Pending local changes | The Infra One topology differs from the last successfully applied version. |
| In sync | The last audit found no governed drift for the record. |
| Drifted | The live provider state differs from the intended state. |
| Missing | The governed provider resource could not be found. |
| Error | The provider read failed or a check could not complete; this is not a clean result. |
| Unmanaged resource | A live drive or group was discovered but is not tracked in the governed topology. |
Provisioning reconciles governed resources only. A partial failure does not stamp the topology as successfully provisioned, so the UI continues to show pending work. Audit errors preserve prior evidence where possible instead of clearing findings.
For permissions, Workspace governance records the grants it created. It can revoke a stale permission only when that permission is in the managed-permission ledger. Unknown provider permissions are not removed merely because they are absent from the topology.
Policy checks
| Check | Current rule |
|---|---|
| Direct user access · G0 | Governed drive roots and managed folders should grant access through groups, not individual users. |
| People directly in access groups · G1 | Access groups should contain role groups rather than people directly. |
| Naming integrity · G2 | Access and external groups must use the configured access and external prefixes. |
| External access (airlock) · G3 | An external group requires an airlock drive that allows users outside the workspace domain. |
| Drive capacity · G4 | A drive can contain up to 100 groups, 600 members, and 50,000 individuals. Above roughly 2,500 indirect members, Google can stop adding the drive automatically to the left navigation. |
| Drive hardening | Governed drive restrictions are compared with the intended domain, membership, sharing, and administrator controls. |
The audit also checks group settings, managed-grant drift, deep group nesting as an advisory, and unmanaged resources. Run live checks requires a Google connection and a Manager grant. Removing a G1 direct member is a separate, immediate provider mutation.
Folder-template states
- A template is a reusable folder tree, with two-space indentation representing nesting.
- Direct children creates the template structure directly in the attached managed folder.
- Per year creates the structure beneath a year folder and allows the year-rollover worker to create later years.
- Editing a template affects later creation only. Existing folders are never renamed or deleted.
- Detaching a template keeps folders already created from it.
Slack audit and enforcement
Slack audit synchronizes channel and member inventory, then evaluates:
- full members against the governed Google directory;
- guest expirations;
- channel naming across non-archived channels;
- membership policy differences in both directions.
The audit is read-only. Auto-add missing members enables the separate enforcement worker to invite missing audience members. Exclusive reports extra members but never removes them automatically. The bot is exempt from membership differences. Archived channels are skipped, and a private channel the bot cannot enter is not enforced.
When Google directory access fails, guest checks still run and prior directory findings are preserved. A dead or revoked Slack token marks the connection for reconnection.
Google and mailbox boundaries
The Google service account requests the core Drive, Directory, Cloud Identity, and Groups Settings scopes as one exact delegated set. Adding a missing scope to the requested set would cause Google to reject a token until the domain-wide delegation entry is updated.
Mailbox delegation uses two optional Gmail scopes minted separately while impersonating the mailbox owner. If those scopes are absent, only mailbox delegation degrades; drives, groups, users, provisioning, and audits continue to work.
Both Gmail scopes are required: one reads delegates and one grants or revokes them. Mailbox and delegate addresses must belong to the connected workspace rules, and Google accepts only a delegate in the same organization as the mailbox. Delegation changes are one-off actions and are not provisioned or checked for drift.
Destructive and external effects
- Apply to Google can create or adopt drives, folders, groups, settings, and permissions.
- Removing a drive, folder, or group from the Infra One setup removes the local desired-state record; it does not delete the corresponding Google resource. Review the resulting pending permission changes before applying again.
- Changing the Google admin identity checks every governed, provisioned drive. If the replacement has no direct user permission, Infra One grants Organizer; any existing direct permission is treated as sufficient without checking its role. It then attempts to remove the previous admin’s direct permission on drives where permission listing and any required grant succeeded. Before the change, make sure the replacement is either not a direct member or already Organizer on every governed drive; correct a lower direct role in Google first. Per-drive errors do not roll back the identity change; review the result, verify the replacement’s role in Google, and run G0 to find access that remains.
- Disconnecting Slack deletes synced local inventory and policies for that connection.
- Auto-add Slack enforcement invites people but never removes extras.
- Removing a mailbox delegate revokes that person’s mailbox access.