> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing/google-drive-playbooks-for-4th-party-sharing.md).

# Google Drive playbooks for 4th party sharing

To mitigate the risk associated with 4th party sharing in Google Drive, you can define automated workflows for these use cases: 

* [Notify on 3rd party sharing with 4th party](#notify-on-3rd-party-sharing-with-4th-party)
* [Revoke 3rd party sharing with 4th party](#revoke-3rd-party-sharing-with-4th-party)

## Notify on 3rd party sharing with 4th party

To mitigate the risk associated with 4th party sharing in Google Drive, you can customize automated workflows to notify your security team whenever an asset in Google Drive is shared with a 4th party. 

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Google Drive app, and select the **Notify on 3rd party sharing with 4th party** playbook.
3. Give an action name.
4. Under the **Change user access** event, define the relevant conditions:

   * The `Get actor email` condition does **not** contain your organizational domain: @yourdomain.com.
   * The `Added collaborators` condition contains at least one that's **not** in your trusted domains
   * The `Has added collaborators` condition is true.

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FlJhcFeQXWCHLOj6rkU3M%2FNotify%204th%20party%20share%20Google.png?alt=media&amp;token=d4e5d20e-5b71-4818-ba7e-40bf2fc914a2" alt="" width="563"><figcaption></figcaption></figure></div>
5. Add any relevant conditions.
6. Customize the **Notify in Slack** action to notify your security team.

When a 3rd party shares an asset with a 4th party in Google Drive, the security team is automatically notified by Slack or email.

## Revoke 3rd party sharing with 4th party

To mitigate the risk associated with 4th party sharing in Google Drive, you can customize an automated, aggregated workflow to prevent third parties from sharing assets with unvetted parties.&#x20;

When a 3rd party shares an asset with a 4th party in Google Drive, the SecOps team is asked to approve the sharing. If the SecOps team does not approve, 4th party collaborators are automatically removed from the asset.

{% hint style="info" %}
When an asset exists in a parent folder, collaborator access is removed from all assets in the folder.
{% endhint %}

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the 4th party sharing category, and select the **Revoke 3rd party sharing with 4th party** playbook.
3. Give the workflow a name and description.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPGeInRvhI6XZ4UbHQTRw%2FRevoke%203rd%20party%20Google.png?alt=media&amp;token=af22ace4-7ef7-4265-8ebf-160723cf426a" alt=""><figcaption></figcaption></figure>
4. Under the **Change user access** event, the relevant conditions are already pre-populated:
   * **Actor is not from the organization** - Actor email is not from your organizational domain
   * **4th party domain is different from 3rd party domain** - The collaborator's domain is different from the actor's domain
   * **New collaborators were added** -`Has added collaborators` condition is true.<br>
5. Add any relevant conditions.
6. The **Event filter** action is pre-populated with the relevant conditions:
   * **4th party domain is different from 3rd party domain** - The collaborator's domain is different from the actor's domain
   * **Actor is not in your trusted domains** - At least one added collaborator is **not** in your trusted domains
7. Customize the **Approval** action to send a message to the SecOps team asking to approve or reject the files shared by 3rd parties with 4th party collaborators. You can send a message via email, Slack or DoControl workflow activities, but the message can only be approved or rejected once.
   * **Yes** - End workflow.
   * **No** or **Timeout** - All 4th party collaborators are automatically removed from the files.\
     Customize the error handling.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing/google-drive-playbooks-for-4th-party-sharing.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.