#Create a Policy

In Policy enforcement, rules and policies work together to enforce compliance, where the rule defines the “what” and the policy defines the “how” and “where”.

For detailed instruction on creating policies, refer to the following sections.

#Automatic Policy

Automatic policies enable continuous, scheduled compliance monitoring by scanning predefined data scopes for rule violations. Administrators configure these policies by selecting rules, defining target object types and conditions, and setting violation handling actions such as reporting, automatic remediation, or approval workflows. These policies operate on a customizable schedule, running scans at specified intervals to ensure ongoing enforcement of security and compliance standards. The system provides full lifecycle management for these policies, including editing, enabling/disabling, and deletion from a centralized interface.

#Create an Automatic Policy

To create an automatic policy, complete the following steps:

1. On the Automatic policies page, click Create policy in the upper-right corner.

2. In the Create policy panel, complete the following configurations in Basic information first:

   • Rule – Select a rule for this policy. For the list of supported rules in the system, refer to Supported Rules.

     You can search for a specific rule by entering the rule name in the Search text box and then selecting it from the suggestion list.

   • Policy name – The policy name will automatically inherit the rule name. You can modify the name based on your needs.

   • Description – Enter a description for the policy

   • Status – Configure whether this policy will be in the Enabled or Disabled status upon creation.

   Click Next.

3. In Scope, define the policies’ monitoring scope by completing the following configurations:

   • Object type – Select an object type for this policy. The available object type to select depends on the selected rule.

   • Conditions – To narrow down the scope, define the conditions. Only objects that match the configured conditions will be included in the policy’s monitoring scope. The available conditions to configure depend on the selected rule.

   Click Next.

4. In Policy details, configure the violation processing approach, notification settings, and scanning schedule for the policy.

   While detailed policy settings differ from one another based on the rule selection, there are some common optional settings during policy creation:

   • Operation – Select the operation to take after a violation is detected. You can select:

     • Report the violation – The violation will be recorded in the Violation Report where both violation details and further actions are available.

     • Fix directly – Configure a fixing action and automatically fix the violation upon detection.

       *Note: This option is not applicable to rules that can only be fixed through manual fixes. For example, for the Manager count restriction rule, when violations are detected, administrators need to decide the user to add or remove from the shared drive’s manager list.

     • Fix through approval process – Evaluate the violation and fixing details through the approval process created in Configure Approval Process.

       *Note: This option is not applicable to rules that require manual fixes. For example, for Manager count restriction, when violations are detected, administrators need to decide the user to add or remove from the shared drive’s manager list.

   • Trigger when an object meets the following conditions– Configure the conditions that triggers the selected operation.

   • Action details – If Fix directly or Fix through approval process was selected, configure the fixing action to take. The selected action will be executed upon violation detection or approval.

   • Approval process – If Fix through approval process was selected, select an approval process.

   • Send violation notifications to – To notify certain user of the detected violation, select the recipients.

   • Schedule – Complete the following schedule setups:

     • Scan start time – Select the time to start the first scan job of this policy.

     • Scan interval – Configure the scan job’s frequency. The interval can be certain days, weeks, or months.

     • Retention duration – Configure the number of days to retain the scanned data of this policy. The maximum duration is 365 days.

5. Click Save and the policy will operate based on your schedule configurations. Or you can click Save and run to assign the policy to the selected scope and run a job immediately.

#Manage Automatic Policies

All created automatic policies will be displayed on the Automatic policies page, where you can manage them by the following operations:

#On-Demand Policy

On-demand policies provide targeted, manual compliance checks for specific Google Workspace objects without scheduled scanning. These policies allow administrators to create customized rules and instantly apply them to selected shared drives or other objects for immediate violation assessment. They are ideal for conducting focused audits, investigating specific security concerns, or verifying compliance before project deployments. Unlike automatic policies, on-demand executions are one-time operations that provide immediate results without creating ongoing monitoring schedules.

For detailed instructions on on-demand policy applying, refer to Apply Policies to Shared Drives.

#Create an On-Demand Policy

To create an automatic policy, complete the following steps:

1. On the On-demand policies page, click Create policy in the upper-right corner.

2. In the Create policy panel, complete the following configurations in Basic information first:

   • Rule – Select a rule for this policy. For the list of supported rules in the system, refer to Supported Rules.

     You can search for a specific rule by entering the rule name in the Search text box and then selecting it from the suggestion list.

   • Policy name – Enter the policy name.

   • Description – Enter a description for the policy

   Click Next.

3. In Policy details, configure the violation processing approach and notification settings.

   While detailed policy settings differ from one another based on the rule selection, there are some common optional settings during policy creation:

   • Object type – If the added rule supports monitoring multiple types of object types, select the object type for this policy.

   • Operation – Select the operation to take after a violation is detected. You can select:

     • Report the violation – The violation will be recorded in the Violation Report where both violation details and further actions are available.

     • Fix directly – Configure a fixing action and automatically fix the violation upon detection.

   • Trigger when an object meets the following conditions – Configure the conditions that triggers the selected operation.

   • Action details – If Fix directly was selected, configure the fixing action to take. The selected action will be executed upon violation detection or approval.

   • Send violation notifications to – To notify certain user of the detected violation, select the recipients.

   • Retention duration – Configure the number of days to retain the scanned data of this policy. The maximum duration is 365 days.

4. Click Save.

After on-demand policies are created, you can manually apply them to your Google Workspace objects in the Administration module. For detailed instructions, refer to Apply Policies to Shared Drives.

#Manage On-Demand Policies

All created on-demand policies will be displayed on the On-demand policies page, where you can manage them by the following operations:

#Supported Rules

The table below lists the supported rules in the system.

Rule	Rule	Applicable Policy Type	Applicable Policy Type	Supported Google Object Types	Supported Google Object Types	Supported Google Object Types	Supported Google Object Types	Supported Google Object Types
Name	Description	Automatic Policies	On-Demand Policies	User Drives	Shared Drives	Groups	Users	Gmail
Admin role assignment restriction	Restrict drive permission assignment of certain users.	Yes	No	No	No	Yes	No	No
Drive user / group restriction	Control users and groups that can be added to drives.	Yes	No	Yes	Yes	No	No	No
Edit permission restriction for sharing links	Restrict the sharing permission shared via sharing links.	Yes	No	Yes	Yes	No	No	No
External access to groups restriction	Detect and restrict external users’ group membership.	Yes	Yes	No	Yes	No	No	No
External email forwarding restriction	Detect and restrict emails being forwarded to external mailboxes.	Yes	No	No	No	No	No	Yes
External group member detection	Detect and report external users in groups.	Yes	Yes	No	No	Yes	No	No
External sharing expiration enforcement	Enforce the expiration time of drive permission shared to external users.	Yes	Yes	Yes	No	No	No	No
External user manager / content manager permission restriction	Report and remove manager or content manager roles from guest users.	Yes	Yes	No	Yes	No	No	No
External user monitor	Detect external users in a shared drive where external sharing is disabled.	Yes	Yes	No	Yes	No	No	No
File permission inheritance protection	Protect permission inheritance from being broken at the file level.	Yes	Yes	Yes	Yes	No	No	No
Group with external users detection	Detect and remove groups with external users from drives.	Yes	Yes	Yes	Yes	No	No	No
Inactive user account detection	Detect inactive user accounts.	Yes	No	No	No	No	Yes	No
Manager / Content manager restriction	Restrict users who can be added to a shared drive as managers.	Yes	No	No	Yes	No	No	No
Manager count restriction	Restrict the number of managers in a shared drive.	Yes	Yes	No	Yes	No	No	No
Manager enforcement	Enforce specific users and groups to be managers of a shared drive.	Yes	No	No	Yes	No	No	No
Member invitation restriction	Detect and remove users invited to shared drives.*Note: This rule can only detect users invited within the last 30 days.	Yes	No	No	Yes	No	No	No
Membership restriction	Restrict users who can be added to a shared drive as members.	Yes	No	No	Yes	No	No	No
Orphaned users drive permission detection	Detect users who have been deleted but has remaining drive permissions.	Yes	Yes	Yes	Yes	No	No	No
Shadow user detection	Remove users who have access to a document in a shared drive but are not members of the shared drive.	Yes	Yes	No	Yes	No	No	No
Shared drive creation restriction	Control who can create shared drives.	Yes	No	No	Yes	No	No	No
Shared drive settings restriction	Restrict content sharing settings for shared drives.	Yes	Yes	No	Yes	No	No	No
Shared permission expiration enforcement	Enforce the expiration time of shared drive permissions.	Yes	Yes	Yes	No	No	No	No
Sharing link restriction	Restrict the creation of sharing links or adding specific audiences to sharing links.	Yes	Yes	Yes	Yes	No	No	No
User permission replacement	Report or remove permissions from a specific user and assign the permissions to other designated users.	Yes	No	Yes	Yes	No	No	No