The Flaw of Binary Sharing Options
In the early iterations of Google Workspace, controlling external collaboration was a binary choice. An IT administrator could either allow users to share Google Docs with anyone on the internet, or completely block all external sharing.
For a modern enterprise, neither option is viable. Blocking external sharing entirely prevents the Sales team from collaborating with clients, paralyzing the business. Conversely, allowing open external sharing means an unhappy engineer can easily share the company’s proprietary source code with their personal Gmail account or a competitor’s domain.
To solve this, Google introduced Trust Rules. Trust Rules provide granular, surgical control over exactly who can share what, and with whom. Instead of a global on/off switch, administrators can create highly specific policies—for example, allowing the HR department to share files exclusively with a specific payroll vendor’s domain, while explicitly blocking them from sharing anything with public @gmail.com accounts.
Step 1: Transitioning to Trust Rules
Trust Rules replace the legacy “Sharing Options” in the Google Admin Console. Because the transition is a fundamental architectural shift, it must be explicitly activated by a Super Administrator.
- Log in to the Google Workspace Admin Console (admin.google.com).
- Navigate to Rules in the main dashboard.
- At the top of the Rules page, look for the banner regarding Trust Rules. If you have not yet transitioned, you must click the prompt to activate them.
Warning: When you activate Trust Rules, Google maps your legacy sharing settings into equivalent baseline Trust Rules. Ensure you review these default rules before making changes.
Step 2: Defining Trusted Domains (Allowlists)
Before creating a granular rule, you must define the external domains that your company formally trusts.
- Navigate to Account > Domains > Allowlisted domains.
- Add the specific domains of your vendors, partners, or subsidiary companies (e.g.,
trusted-vendor.com,law-firm.net).
These domains are now available as specific targets within the Trust Rules engine.
Step 3: Creating a Restrictive Trust Rule
Suppose you want to implement a strict security policy for your internal Engineering team: They are absolutely forbidden from sharing files with any external entity, except for your authorized external QA testing vendor (qa-vendor.com).
- Navigate to Rules > Trust Rules.
- Click Create Rule.
- Name the rule: “Engineering Data Containment”.
- Scope: This is the most critical step. Do not apply this to the entire domain. Select the specific Organizational Unit (OU) containing your Engineering team.
- Trigger: Select Sharing files.
- Condition: Choose External users.
Step 4: Configuring the Action and Exceptions
Now you must define exactly what happens when an engineer attempts to share a file.
- Under the Action section, select Block. This establishes the baseline: the Engineering OU cannot share anything outside the company.
- However, we must add the exception for the QA vendor. Look for the Exceptions or Allowlisted Domains toggle within the action configuration.
- Select the
qa-vendor.comdomain you defined in Step 2.
Save and activate the rule.
Now, if an engineer opens a proprietary design document and tries to share it with competitor.com or [email protected], Google Drive will immediately throw a red error stating the action violates corporate policy. If they type [email protected], the share will succeed seamlessly.
Step 5: Controlling Inbound Sharing (Receiving Files)
Trust Rules are bidirectional. Data exfiltration (sharing out) is a massive risk, but data infiltration (receiving files) is equally dangerous. A common phishing vector involves a malicious actor sharing a weaponized Google Doc (containing links to malware) with a corporate employee.
You can create a Trust Rule specifically for Receiving files.
For high-security OUs (like Finance or the C-Suite), you can create a Trust Rule that explicitly blocks them from opening or receiving any Google Drive files originating from unverified external domains, while allowing files from your internal domain and your explicitly defined Allowlist.
Conclusion
The binary “all or nothing” approach to cloud sharing is incompatible with modern security frameworks. By deploying Google Workspace Trust Rules mapped to specific Organizational Units and curated domain allowlists, IT administrators can build a zero-trust collaboration environment—empowering necessary business workflows while mathematically preventing unauthorized data exfiltration.