Google Drive Governance: File-Sharing Risks and How to Control Them

By Patronum

November 05, 2026

Read Time: 7 mins

Google Drive Governance: File-Sharing Risks and How to Control Them image

What does Google Drive governance cover?
Which file-sharing risks matter most?
Native Drive governance controls, in the order to set them
A simple Google Drive governance policy template
How Patronum enforces a Drive sharing policy
Putting it together: a 150-person company on Business Standard
Sources

Google Drive governance means deciding who can share what, with whom, and checking that it stays that way. In Google Workspace, you set the rules in the Admin console, watch them with Drive log events, and clean up what slipped through. The hard part isn’t the settings. It’s the files that were shared before the settings existed, and the ones owned by people who’ve left.

Patronum helps with that cleanup: its Drive policies, part of Patronum Plus according to its help center, find files shared outside your domain or by link and unshare them or email the owner first, on a schedule.

What does Google Drive governance cover?

Six areas, each with its own risk.

Area	The risk	Where to go deeper
Ownership	Files owned by one person, stuck when they leave	Transfer Drive file ownership
Sharing	Files open to anyone with the link, or to personal Gmail accounts	Remove anyone-with-the-link sharing
External access	Outside domains with edit access to internal files	Google Drive permissions explained
Shared drive structure	Drives with no managers, or open to non-members	Shared drive permissions
Leavers’ files	Data that goes unowned or gets deleted with the account	Google Workspace offboarding
Audit	No record of who shared what, or when	Audit Drive access and sharing logs

Anyone-with-the-link files. No sign-in is needed, so a forwarded or pasted URL is enough to open the file.
Shares to personal accounts. A file shared to a gmail.com address stays open to that account until someone removes the share.
Downloads by viewers. A viewer who can download, print or copy can take a copy outside your control, and removing their access later doesn’t bring that copy back. See how to restrict downloads.
Shared drives nobody manages. If a drive has no managers, nobody’s watching its membership.

Native Drive governance controls, in the order to set them

Set them top to bottom; each step narrows what the next has to catch. Changes can take up to 24 hours, so test with one organizational unit first. Google’s supported editions per control, read 5 November 2026:

Control	Supported editions
External sharing on or off, allowlisted domains	No edition list shown for these settings (Google)
General access default	Business Standard and Plus; Enterprise Standard and Plus; Education Standard and Plus; Nonprofits; G Suite Business (Google)
Shared drive creation and defaults	Business Starter, Standard and Plus; Enterprise Standard and Plus; Education Fundamentals, Standard and Plus; Essentials, Enterprise Essentials and Enterprise Essentials Plus; Nonprofits; G Suite Business (Google)
Trust rules	Frontline Plus; Enterprise Standard and Plus; Education Standard and Plus; Enterprise Essentials Plus (Google)
DLP for Drive	Frontline Standard and Plus; Enterprise Standard and Plus; Education Fundamentals, Standard and Plus; Enterprise Essentials Plus (Google)
Security investigation tool (act on Drive search results)	Frontline Standard and Plus; Enterprise Standard and Plus; Education Standard and Plus; Enterprise Essentials Plus; Cloud Identity Premium (Google)
Vault (included)	Frontline Standard and Plus; Business Plus; Enterprise Standard and Plus; all Education editions; Enterprise Essentials and Enterprise Essentials Plus (domain-verified only); G Suite Business. Add-on for others through Google Sales (Google)

In Apps > Google Workspace > Drive and Docs > Sharing settings, turn sharing outside your organization on or off and limit it to allowlisted domains. Settings apply per organizational unit or configuration group, and “Group settings override organizational unit settings” (Google). A common pattern is to turn external sharing off at the top level, then turn it on for the teams that need it.

2. The general access default for new files

Under Sharing settings > General access default, choose what a new file’s link opens to. By default it’s Restricted, and it applies to new items, not existing ones (Google).

3. Shared drive settings

Under Sharing settings > Shared drive creation, decide who can create shared drives, whether managers can override your settings, whether outsiders and non-members can get access, and whether viewers and commenters can download, print and copy (Google). Then open Manage shared drives and use the “No managers” filter to find drives nobody owns (Google).

4. Trust rules (editions in the table above)

Trust rules control who can share with whom, by user, group, organizational unit or domain, and replace the “Sharing outside of your organization” setting. You can turn them off later, but “Any trust rules you created are permanently deleted” (Google). Preview the converted rules before you switch.

5. DLP for Drive (editions in the table above)

Data loss prevention rules check file content. A Drive rule can block external sharing or disable download, print and copy for commenters and viewers. Leave the actions empty and the rule only logs incidents in the rules audit log, which is the safe way to start. When you activate a rule, DLP scans the documents it applies to (Google).

6. Drive log events and the investigation tool

Reporting > Audit and investigation > Drive log events records views, edits, downloads, deletes and visibility changes; you need the Audit & Investigation admin privilege to open it. Google logs most Drive events only for files owned by users on supported editions (Google). Events arrive within minutes and are kept for 6 months (Google), so export what you need longer. The security investigation tool can change link sharing or permissions on files from a search, but not on folders (Google). Our Drive audit guide walks through the searches.

7. Vault, for files you must keep

Vault can retain, hold, search and export Drive files. Decide preservation before deleting accounts. If you rely on Vault, retain the account with the appropriate licensing; setting a retention rule does not make account deletion safe (Google). Our leaver data retention guide covers the decisions.

A simple Google Drive governance policy template

Copy this, fill the brackets, and get it signed off by whoever owns data protection.

GOOGLE DRIVE SHARING POLICY: [Company name]
Owner: [name, role]          Review date: [date]

1. Default link access for new files: Restricted.
2. External sharing: off by default. On for [OUs/groups],
   limited to [allowlisted domains] where possible.
3. Anyone with the link: not allowed for [confidential data types].
   Allowed exceptions: [e.g. public marketing assets], kept in
   [named folder or shared drive].
4. Shares to personal accounts (gmail.com etc.): not allowed for
   company files.
5. Shared drives: created by [who]. Every drive has at least
   [2] managers. Non-members can't be added to files.
6. Leavers: for planned exits, hand over working files before the
   last day, then complete the ownership transfer with [method]
   once access is closed. For urgent exits, close access first and
   transfer files afterwards. Check holds with [records owner]
   before any transfer or deletion.
7. Review: external and link sharing reviewed every [month/quarter]
   by [team]. Owners get [X] days' notice before access is removed.
8. Records: Drive log events exported monthly; decisions logged in
   [system].

On point 6: Google’s Admin console transfer asks you to suspend the current owner first so they can’t change content mid-transfer, and it can’t transfer from an account on litigation hold (Google). The order for urgent exits is in our guide to offboarding an employee immediately.

Point 7 is the one that slips. That’s where automation helps.

In Patronum, a policy with its trigger set to Drive turns points 3, 4 and 7 into a rule that runs on its own. Patronum’s help center lists custom file governance policies as a Patronum Plus feature, and documents these steps (Patronum Help):

Scope. Target users by organizational unit or Google Group, and choose whether the policy looks at files in My Drive or Shared Drives.
Filter. Pick what counts as a violation: “Anyone with the Link”, “Any External Domain”, “Any Domain outside Allowlist”, Gmail.com, or files shared a set number of days ago.
Act. Unshare files after a delay, email the file owner (or the Drive manager for shared drives), apply Drive labels, expire access on a date, or send a preview report to named recipients. To start safely, run a report-only policy first, with Unshare and the other changing actions left out, review the report, then add the changes.
Activate. A new policy stays inactive until you activate it. It then runs hourly by default, and the first run can take up to 60 minutes (Patronum Help).

Unsharing stops future access through Drive. It doesn’t retrieve copies already downloaded, so pair it with download restrictions for sensitive files.

Files flagged by a policy appear on the Compliance tab of the Drives area, with who they’re shared with, the access type and permission.

Patronum Compliance tab listing files shared as Anyone With the Link
Patronum console, demo environment (November 2026): the Compliance tab, listing files shared with “Anyone With the Link”.

In the demo environment, that list is mostly social icons used in email signatures. They’re shared by link on purpose, because signature images hosted in Drive need a public link to display, as our guide to storing signature images in Drive explains. A blanket unshare could break signatures that use those images. That’s why the policy template names allowed exceptions, and why Patronum lets you safe-list or snooze a file: “Files that have been snoozed or safelisted will not be unshared.”

The File Sharing tab shows how many files each account holds by role, a quick way to spot who to talk to first.

Patronum File Sharing tab showing file counts per account by role, with names blurred
Patronum console, demo environment (November 2026): per-account file counts by role on the File Sharing tab (names blurred).

Before you buy: Patronum’s help center lists file compliance automation, automated file expiry and custom file governance policies as Patronum Plus features at $16 per user per year (Patronum Help), while the public pricing page shows Business at $8 per user per year and doesn’t mention Plus (Patronum pricing). Confirm which plan your quote covers. Weighing other tools? Our Google Drive governance tools comparison sets them side by side.

Putting it together: a 150-person company on Business Standard

Say you run Google Workspace Business Standard for 150 people. Trust rules, DLP for Drive, the security investigation tool and included Vault aren’t on Business Standard’s supported lists (Vault is sold as an add-on), so your native tools are steps 1 to 3 plus the Drive log events report.

Turn external sharing off at the top level and on for Sales and Customer Success, allowlisted to your main client domains.
Leave the general access default at Restricted.
Stop most users creating shared drives, and find any drive with no managers.
Open Reporting > Audit and investigation > Drive log events as an admin with the Audit & Investigation privilege, filter for visibility changes, and export the results (Google keeps them for 6 months).
Clean up existing anyone-with-the-link files by hand, with Google’s own views, or with a tool, and safe-list the exceptions your policy allows.
Put the review from point 7 of the template in the calendar, or in a scheduled policy.

Check it worked: a day after changing settings, have a test user in an OU with external sharing off try to share a file with a personal Gmail address. It should be blocked. Repeat from an OU where sharing is on, and confirm the share appears in your next review.