Google Drive Permissions Explained: Roles, Sharing, and Who Can See What

By Patronum

July 07, 2026

Read Time: 6 mins

Google Drive Permissions Explained: Roles, Sharing, and Who Can See What image

How Google Drive permissions work
A concrete example
Common misconceptions
The scale of the problem
FAQ
See every permission in one place
Sources

Google Drive permissions are the access levels that decide what people can do with your files and folders. In My Drive, the roles are Viewer, Commenter, and Editor, plus the file Owner. Shared drives use five roles: Manager, Content manager, Contributor, Commenter, and Viewer. Each role grants a specific, fixed set of actions.

That’s the whole idea in one breath. The details are where people trip up, so let’s walk through them slowly. Once the roles click into place, sharing stops feeling like guesswork.

Why does getting this right matter? Because the wrong permission quietly exposes data you meant to keep private. A budget shared too widely. A contractor who still has Editor access months after the project ended. Most oversharing isn’t malicious. It’s just a setting nobody circled back to fix. The rest of this guide is how you avoid that.

How Google Drive permissions work

Permissions work by attaching a role to each person you share with, then layering a general access setting on top for anyone you didn’t name directly. Here’s how the pieces fit.

The My Drive roles

In your personal My Drive, files use three roles plus the Owner. Each role allows a fixed set of actions, summarized below.

Role	View	Comment	Edit	Download	Share	Change permissions
Viewer	Yes	No	No	Yes by default (owner can turn off)	No	No
Commenter	Yes	Yes	No	Yes by default (owner can turn off)	No	No
Editor	Yes	Yes	Yes	Yes	Yes (cannot change owner)	Yes by default (owner can turn off)
Owner	Yes	Yes	Yes	Yes	Yes	Yes

Source: Google Drive Help, “Share files from Google Drive”. Note: these roles apply to files in My Drive.

General access versus specific people

Beyond the people you name, every file has a general access setting. Depending on your organization’s sharing policies, general access may be Restricted (only people you’ve added can open it), limited to an approved audience, Anyone with the link, or Public (Google Drive Help). What’s actually available depends on your account type and your administrator’s sharing controls. “Restricted” is the careful default. “Anyone with the link” is the convenient one that gets people into trouble.

Inheritance

Folders pass their access down. Any access you apply to a folder is inherited by all the files within it, and you can no longer give someone less access to an individual file if they already have higher access to its parent folder (Google Drive Help). So if your teammate is an Editor on the folder, you can’t quietly demote them to Viewer on one file inside it. Google’s own workaround: create a subfolder with limited access and move the sensitive file there (Google Drive Help, “Limit access to folders”).

My Drive sharing versus shared-drive roles

This is the part most explainers blur, so read it twice. My Drive is personal: you own your files, and you work with three roles. Shared drives are owned by the organization, use five roles, and the default role for a new member is Content manager.

The five shared-drive roles, per the Google Workspace Learning Center, “How file access works in shared drives”:

Manager is the highest level. A Manager can do everything, including setting limited access to folders, moving folders between shared drives, adding or removing members, changing member access levels, permanently deleting files in Trash, and renaming or deleting the shared drive.
Content manager is the default for new members. They can view, comment, edit, create or add files, move files and folders to Trash, and move files and folders within the shared drive. They cannot manage membership or permanently delete.
Contributor can view, comment, edit, create, and add files. They cannot move files or folders within the shared drive, and cannot move them to Trash.
Commenter can view and comment only.
Viewer can view only.

Ownership works differently here too. In My Drive, every file has a single Owner with ultimate control, including the ability to transfer ownership. In a shared drive, individual files don’t have a personal owner the same way. The organization owns the shared drive, and Managers hold the top administrative role. When you move a file you created into a shared drive, you’re still the creator but no longer the owner (Google Workspace Learning Center).

One caveat that surprises admins: on Google Drive for desktop or the Chrome OS Files app, Contributor access gives only read access. To let those users create, upload, and edit, you have to grant Content manager or Manager (Google Workspace Learning Center).

What admins can enforce (beyond roles)

A role is not the only thing that controls access. On top of any role, a shared-drive Manager or your Workspace administrator can layer restrictions: prevent sharing outside the organization, block sharing with non-members, restrict specific folders with limited access, and turn off downloading, copying, and printing for Commenters and Viewers (Google Workspace Learning Center; Google Drive Help, “Limit access to folders”). So a person’s real, file-level access can be narrower than a role table alone suggests. This is the layer casual Drive users rarely see, and the one admins should reach for first.

Which role should I choose?

A quick rule of thumb when you’re deciding what to grant:

Viewer: read-only reference material.
Commenter: review and feedback, without edits.
Editor: active collaboration on your own My Drive files.
Content manager: day-to-day team content in a shared drive.
Manager: a very limited number of admins or content owners who genuinely need full control.

A concrete example

Picture Priya, a marketing manager, sharing a campaign budget Sheet. She adds her teammate as Editor, so he can update the numbers. She adds her manager as Commenter, so he can leave notes but not change figures. She sets general access to Restricted, so nobody else can open it.

Then plans change. Priya needs to send the budget to an outside agency that doesn’t have Google accounts she can name. So she switches general access to Anyone with the link, set to Viewer. If her organization allows external link sharing, anyone who receives the link can then open the Sheet without signing in.

Here’s the catch worth pausing on. That link now works for anyone who receives it, signed in or not. People who open it without signing in show up as anonymous animals in the file (Google Docs Help). Convenient, yes. But if that link gets forwarded, the budget travels with it, which is exactly why admins often restrict external link sharing in the first place.

Common misconceptions

A few beliefs about Google Drive permissions are just wrong, and they’re wrong in ways that leak data.

“Viewers can’t download.” False by default. Viewers and Commenters can download, print, and copy files unless the owner turns that off in the file’s advanced sharing settings (Google Drive Help).

“Removing someone from a shared drive doesn’t touch their direct shares.” Also false. When you remove a member from a shared drive, they lose access to files and folders in it that were directly shared with them too (Google Workspace Learning Center).

“Editor and Content manager are the same thing.” They’re not. Editor is a My Drive role. Content manager is a shared drive role, and it can’t manage membership (Google Drive Help; Google Workspace Learning Center).

“I can give someone less access to one file than to its parent folder.” Not anymore. The updated sharing model doesn’t allow it (Google Drive Help).

These small errors add up across a whole company.

The scale of the problem

None of this stays theoretical, and the numbers are sobering, though they come with a caveat. Varonis found the average organization had more than 157,000 sensitive records exposed, adding up to roughly $28 million in data-breach risk, that 81% of organizations had sensitive SaaS data exposed, and that one in 10 sensitive files was exposed to every employee (Varonis, “The Great SaaS Data Exposure Report,” 2022). Those are broad SaaS findings, not Google Drive-specific benchmarks, so treat them as the shape of the problem rather than a precise Drive measurement. The dynamic, though, is the same one the roles above describe.

Sharing also moves faster than anyone can track by hand. SaaS Alerts recorded more than 15,787 files shared every hour across the SaaS it monitors, with 37.28% of shares leaving the organization (SaaS Alerts, “2025 SaaS Application Security Insights (SASI) Report”). That is a lot of links to keep track of manually.

FAQ

Can a Viewer download a file in Google Drive? Yes, by default. Viewers and Commenters can download, print, and copy files unless the owner turns that off in the file’s advanced sharing settings (Google Drive Help).

What is the difference between Editor and Content manager? Editor is a My Drive role: view, comment, edit, share, and, by default, change permissions. Content manager is a shared drive role: it can add, edit, and move content and move files to Trash, but it can’t add or remove members or change access levels. Those membership controls belong to the Manager (Google Drive Help; Google Workspace Learning Center).

What is the difference between Contributor and Content manager in a shared drive? Both can view, comment, edit, and create files. Content manager can also move files and folders within the shared drive and move them to Trash; Contributor can’t. Also, on Google Drive for desktop, Contributor gives only read access, so creating and editing requires Content manager or Manager (Google Workspace Learning Center).

What does “Anyone with the link” mean? It sets general access so anyone who has the link can open the file without signing in to a Google account, if your organization permits external link sharing. You still choose the role, Viewer, Commenter, or Editor, that the link grants. People who aren’t signed in appear as anonymous animals (Google Drive Help).

Does the file owner still control a file after moving it into a shared drive? No. When you move a file you created into a shared drive, you remain the creator but are no longer the owner. The shared drive, meaning the organization, takes over, and if access settings change you can even lose access to your own file (Google Workspace Learning Center).

How does folder permission inheritance work? Access applied to a folder is inherited by every file inside it. You can’t give someone less access to a single file than they already have on the parent folder. To make one file more private, create a limited-access subfolder (Google Drive Help; Google Drive Help, “Limit access to folders”).

See every permission in one place

Knowing the roles is step one. Seeing every permission across your whole domain, in one place, is step two. Patronum gives admins domain-wide visibility of who can access which Google Drive files, and supports bulk remediation of oversharing, so you fix it across every user at once instead of file by file.

If you manage Google Workspace, it’s worth seeing your real picture rather than guessing. Take a look at Patronum’s Google Drive management features, or start a Patronum 30-day free trial and run your first permission audit.