Manage topology, templates, Slack, and mailboxes

This guide produces a governed drive-and-group topology, a reusable folder structure, reviewed Slack membership policies, and—when needed—a deliberate mailbox-delegation change.

Before you begin

You need:

• the workspace_governance rollout flag and an explicit grant for the intended organization;
• a Manager grant for topology, audits, provisioning, templates, and Slack policy enforcement;
• an Admin grant for Google or Slack connections and mailbox delegation;
• a tested Google Workspace connection for drive, group, user, and audit work;
• a Slack connection before managing Slack channels or members;
• an approved list of drives, folders, groups, Slack audiences, and mailbox delegates.

Use fictional or approved operational names in any support material. Never paste Slack tokens, service-account credentials, private-channel content, mailbox contents, or personal messages into documentation or tickets.

Govern a drive and its access groups

1. Open Drives and select Add drive, or select an imported observed drive and choose Manage.
2. Enter the drive name and review all Hardening controls. They are enabled by default.
3. Enable Airlock drive only when the drive is intended to receive an external group.
4. Save the drive, then add its managed top-level folders. Nested folders inherit the access of the managed ancestor.
5. Open Groups and add or review the required group types:
   • Role for people with the same job function;
   • Access for granting role groups access to drives;
   • External for outside collaborators with membership expiration;
   • Distribution for a mailing list.
6. Open the drive’s Access tab and select Add grant.
7. Select an access or external group, the permission, and optionally a managed top-level folder. Use Manage at the drive root only after reviewing its wider authority.
8. Return to Overview, select Apply to Google, then run Audit now.

Workspace governance applies group-based access. Direct user access · G0 and People directly in access groups · G1 identify paths that bypass that model. A manager can remove a direct user from an access group from the finding; that action changes Google immediately, so verify the person and group first.

Selecting Stop managing or Remove changes the Infra One topology; it does not delete the corresponding drive in Google. Provisioning revokes only stale permissions previously recorded as managed by Workspace governance. It does not delete arbitrary provider permissions.

Create and attach a folder template

1. Open Folder templates and select Add template.
2. Enter a name and describe one folder per line. Indent a line with two spaces to nest it under the folder above.
3. Select Create template.
4. Under Attachments, choose the template and a managed folder.
5. Choose a mode:
   • Direct children creates the template’s folders inside the selected folder;
   • Per year creates the structure under a year folder and schedules future year folders.
6. Select Attach.
7. For a direct attachment, select Create folders. For a yearly attachment, select Create year now when the current year must be created immediately.
8. Audit the topology after the resulting folders are provisioned.

Editing a template affects the next creation. Existing folders are never renamed or deleted. Detaching a template also keeps folders that were already created.

Connect and audit Slack

1. With a Workspace governance Admin grant, open Settings.
2. Under Slack workspace, select Connect Slack. Approve both the governance bot and your own admin authorization.
3. If the deployment says the Slack governance app is not configured, ask a platform administrator to provision it from the app configuration token. Do not paste that token into a ticket.
4. If Settings says the workspace still uses a previous app, select Reconnect Slack.
5. Set the approved channel prefixes and decide whether to enable the direct-message naming nudge, then select Save naming policy.
6. Open Slack channels and select Audit now to load channel and member inventory.
7. Add a Membership policy for a channel. Choose an audience: all full members, a Google group, or a Slack user group.
8. Enable Auto-add missing members only when the policy may invite people automatically.
9. Enable Exclusive when people outside the audience should be reported as findings.
10. Review Slack members for directory mismatches, suspended directory users, foreign domains, missing email visibility, and guest-expiration findings.

Slack audit itself is read-only. An auto-add policy can invite missing audience members, but an Exclusive policy never removes extra members automatically. Extra people remain findings for human review. Archived channels are not enforced, and a private channel the bot cannot enter is skipped.

Delegate a mailbox

Mailbox delegation lets one person read, send, and delete email and view or add contacts in another mailbox in the connected domain without sharing its password. It is an Admin-only one-off action, not part of topology provisioning or scheduled drift checks.

1. Open Settings and select Manage mailbox delegates.
2. Enter the mailbox address and select Show delegates.
3. If Authorize the Gmail scope appears, ask a Google Workspace super admin to edit the existing domain-wide delegation entry.
4. Caution: Before editing, copy the entry’s complete current scope list. Google Admin replaces the entire list when you save. The mailbox page’s Copy scope value contains only the two Gmail scopes; saving that value by itself removes the core Drive, Groups, and user-directory scopes.
5. Append both displayed Gmail scopes to the copied current list, then save the complete combined list back to the same client-ID entry. Before leaving Google Admin, confirm that the saved entry contains every scope from the copied list plus both Gmail scopes.
6. Allow the scope change to propagate. This usually takes a few minutes but can take up to 24 hours. If Authorize the Gmail scope still appears, wait before editing the entry again; do not re-save a partial scope list.
7. Open Settings and select Test connection. Treat this as a supplemental check: an immediate pass can reuse the current access token and does not prove that the saved delegation entry is complete. If the test fails, do not continue. Compare the saved entry with the complete list you copied and restore any missing core scopes, then wait for propagation and test again. If the scope list is intact, follow Troubleshoot Workspace governance instead of editing the entry again.
8. Return to the delegation page, enter the mailbox again, and select Show delegates.
9. Under Add a delegate, enter a person in the same Google organization and select Add delegate.
10. To revoke access, select Remove for the exact delegate and confirm the action.

Adding is asynchronous in Google and can take a few minutes to appear. Removal is intended to revoke the delegate’s access immediately. Infra One trims and lowercases mailbox and delegate addresses before comparing their domains and calling Google. Naming-integrity checks also compare the email local part and configured group prefixes case-insensitively.

Success check

The governed drive and group show the intended access with an audit result of In sync or an explicitly reviewed finding. The folder template appears under Attachments in the intended mode. Slack inventory has a current Last audited value and every membership or guest finding has an owner. If mailbox delegation was changed, the exact mailbox and delegate show the expected state after Google’s propagation delay.

Troubleshooting

• You have changes not yet applied to Google Workspace. Review the local topology, then select Apply to Google. Creating a local record alone does not change Google.
• No access or external groups defined. Create the required acc- or ext- group first, then retry the grant.
• An external group cannot be granted. Confirm that the drive is an airlock and permits users outside the workspace domain.
• A template changes but existing folders do not. This is expected. Template changes apply only to later folder creation.
• Slack not connected. Return to Settings, connect or reconnect the governance app, then run Audit now.
• Slack reports missing members but adds nobody. Confirm that Auto-add missing members is enabled and that the bot can join the channel. Exclusive does not remove extras.
• A mailbox page shows Authorize the Gmail scope. Copy the existing client-ID entry’s complete current scope list, append the two displayed Gmail scopes, save the complete combined list, and confirm that every original scope remains. The mailbox page’s Copy scope value contains only the Gmail scopes. After propagation, run Test connection as a supplemental check, then return to the mailbox page and select Show delegates.
• A new delegate is absent immediately after success. Wait a few minutes, then select Show delegates again. Google creates the delegation in the background.

Related pages

• Workspace governance overview
• Set up Workspace governance
• Workspace governance permissions and states
• Troubleshoot Workspace governance