Skip to main content

Understanding Permissions

Learn how to analyze and interpret Drive permissions.

Permission Types​

DriveAuditr shows four types of permissions:

User Permissions​

Individual people with access to a file.

  • Shows their email address and display name
  • Most common type of permission
  • Example: john@example.com has editor access

Group Permissions​

Google Groups with access.

  • Shows group email (e.g., sales@example.com)
  • All group members inherit the permission
  • Useful for team-wide access

Domain Permissions​

Your entire organization has access.

  • Shows domain name (e.g., example.com)
  • Anyone with an email at this domain can access
  • Common in enterprise environments

Anyone Permissions​

Public access - the file is accessible by anyone with the link.

  • No authentication required
  • Highest security risk
  • Should be reviewed carefully

Permission Roles​

Each permission has a role defining what they can do:

Owner​

  • Full control of the file
  • Can delete the file
  • Can change sharing settings
  • Transfer ownership

Writer/Editor​

  • Can edit file contents
  • Can comment and suggest
  • Can share with others (if enabled)
  • Cannot delete or transfer ownership

Commenter​

  • Can add comments
  • Can view contents
  • Cannot edit
  • Cannot share

Reader/Viewer​

  • Can only view the file
  • Cannot edit or comment
  • Can still download (unless restricted)

Security Analysis​

Finding Public Files​

Public files are the biggest security risk. Find them by filtering:

  1. Filter Permission Type = anyone
  2. Review each file:
    • Does it contain sensitive data?
    • Should it be public?
    • Can you restrict access?

Finding External Shares​

Files shared with people outside your organization:

  1. Filter Permission Email for external domains
  2. Check Permission Domain for non-company domains
  3. Review if external access is necessary

Finding Over-Privileged Access​

Users with more access than needed:

  1. Filter Permission Role = owner or editor
  2. Ask: Do they need edit access?
  3. Consider downgrading to viewer if appropriate

Common Scenarios​

Scenario 1: Finding Files Shared Outside Company​

You work at acme.com and want to find files shared externally:

  1. Filter Permission Email column
  2. Look for emails NOT ending in @acme.com
  3. Review each external share

Scenario 2: Audit Files You Own​

Find files you own and their sharing:

  1. Filter Owner = your email
  2. See all permissions on your files
  3. Remove unnecessary access

Scenario 3: Finding Public Documents​

Find publicly accessible files:

  1. Filter Permission Type = anyone
  2. Check Permission Role (often reader)
  3. Review if public access is intentional

Scenario 4: Group Access Review​

See what files a group can access:

  1. Filter Permission Email = group email
  2. See all files the group has access to
  3. Review roles assigned to the group

Best Practices​

Regular Audits​

  • Run audits monthly or quarterly
  • Set up weekly scheduled audits
  • Review results consistently

Principle of Least Privilege​

  • Give minimum necessary access
  • Viewer > Commenter > Editor > Owner
  • Remove access when no longer needed

Review External Sharing​

  • Limit external shares
  • Use domain permissions for team files
  • Avoid public/anyone permissions for sensitive data

Document Ownership​

  • Ensure files have clear owners
  • Transfer ownership when people leave
  • Avoid orphaned files

Taking Action​

After identifying issues:

  1. Remove Public Access: Change "anyone" to specific users
  2. Revoke External Shares: Remove outside access if not needed
  3. Downgrade Permissions: Change editors to viewers if possible
  4. Transfer Ownership: For departing employees' files

Make changes directly in Google Drive, then run a new audit to verify.

Limitations​

DriveAuditr is read-only. It:

✅ Shows you all permissions ✅ Helps identify issues ✅ Exports to spreadsheet

❌ Cannot automatically remove permissions ❌ Cannot change sharing settings ❌ Cannot enforce policies

You must make changes manually in Google Drive after reviewing the audit.