The Ownership Catastrophe
The fundamental flaw of standard Google Drive (“My Drive”) in a corporate environment is that files are inextricably linked to the user who created them. If John, a marketing manager, creates a massive folder containing 500 gigabytes of final advertising videos and shares that folder with the rest of the company, John remains the mathematical owner of those files.
If John resigns and the IT administrator deletes his Google Workspace account to save licensing costs, a catastrophic chain reaction occurs. Because John owned the files, deleting his account permanently obliterates the 500GB of marketing videos. The entire marketing department wakes up the next day to find empty folders. IT is then forced into a desperate 20-day race to restore the deleted user account and manually transfer ownership of thousands of files to a service account before the data is purged from Google’s servers forever.
To permanently solve the data ownership crisis, Google introduced Shared Drives. Shared Drives fundamentally rewrite the Google Workspace permissions architecture. In a Shared Drive, the Company owns the data, not the individual. If John creates a file inside a Shared Drive and then quits the next day, his account deletion has zero impact on the data. The file remains perfectly intact in the Shared Drive. Furthermore, Shared Drives allow administrators to enforce brutal, Zero-Trust security segregation between departments, ensuring that Sales can never access Engineering’s data.
Step 1: The Organizational Prerequisite
Shared Drives are an enterprise-tier feature (available on Business Standard and higher). They are disabled by default for end-users to prevent the chaotic proliferation of thousands of unmanaged drives.
Before deploying, you must architect the permission structure. IT should control the creation of Shared Drives, not the users.
- Log into the Google Workspace Admin Console (admin.google.com).
- Navigate to Apps > Google Workspace > Drive and Docs > Sharing settings.
- Click on Shared drive creation.
- Check the box labeled Prevent users in your organization from creating new shared drives.
This enforces a strict governance model. If the Finance department needs a new drive, they must submit an IT ticket, allowing you to build it securely.
Step 2: Creating the Segregated Drives
Once you have locked down creation, you build the departmental silos.
- In the Admin Console, navigate to Apps > Google Workspace > Drive and Docs > Manage shared drives.
- Click the + button to create a new drive. Name it explicitly, e.g.,
DEPT_Finance_Confidential. - Create another named
DEPT_Engineering_SourceCode.
By default, these drives are completely empty and invisible to everyone in the company, including the CEO.
Step 3: Managing Membership at the Group Level
The cardinal rule of Shared Drive administration is: Never add individual users. Always use Google Groups.
If you add 50 individual engineers to the Engineering Shared Drive, you must manually remove them one by one when they leave the company. This guarantees a security breach when an IT tech inevitably forgets to remove a terminated employee.
Instead, create a Google Group (e.g., [email protected]). Add the employees to the Group.
- In the Shared Drive management console, click Manage Members for the Engineering drive.
- Type in the email address of the Google Group.
- Assign the specific role.
Now, when an engineer leaves the company, you simply remove them from the grp_engineering_all Group, and they instantly lose access to the Shared Drive.
Step 4: Defining the Strict Roles
Google provides highly granular, un-bypassable roles for Shared Drives. You must assign the lowest possible privilege to the Group.
- Viewer: Can only read files. (Perfect for a company-wide “HR Policies” drive).
- Commenter: Can read and leave comments, but cannot alter the text.
- Contributor: The standard role. Users can create new files and edit existing files, but they cannot delete files. This is critical. If a disgruntled employee tries to drag the entire Finance folder into the trash, Google Drive blocks the action.
- Content Manager: Can create, edit, and delete files. (Reserve this for department heads).
- Manager: Complete control. Can delete the entire drive and modify membership. (Reserve this exclusively for the IT department).
Step 5: Enforcing the Security Perimeter (Drive Settings)
Just because you locked down who can access the drive doesn’t mean the data is secure. A “Contributor” in the Engineering drive could still click a file and share it externally to a @gmail.com address.
You must lock the perimeter of the drive itself.
- In the Admin Console, open the specific Shared Drive and click the Settings (Gear Icon).
- External Sharing: Uncheck “Allow people outside your organization to access files.” This mathematically prevents any file in the drive from ever leaving the corporate domain, regardless of what the user tries to do.
- Non-Member Sharing: Uncheck “Allow people who aren’t shared drive members to access files.” This is the Zero-Trust enforcer. It means an Engineer cannot even share a file with the Sales team internally. The data is violently quarantined to the exact members of the Engineering Group.
- Download/Print Restrictions: You can explicitly check a box to prevent Viewers and Commenters from downloading, printing, or copying files, stopping low-level contractors from exfiltrating data to their personal USB drives.
Conclusion
Relying on standard “My Drive” folders for corporate collaboration results in a chaotic, unmanageable mess of tangled permissions and catastrophic data loss during employee offboarding. By transitioning the organization to Google Workspace Shared Drives, IT administrators shift data ownership from the user to the corporation. Coupling strict Group-based roles with impenetrable external sharing settings creates a Zero-Trust data perimeter, ensuring that departmental data remains completely segregated and perfectly secure.