> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/bulk-remediation.md).
# Bulk remediation
In today's data-driven world, maintaining the security and integrity of your digital assets is paramount. As organizations grow and evolve, managing file permissions across your data repositories can become a daunting task. Bulk remediation allows you to effectively address the technical debt challenges arising from permission sprawl. Bulk actions help to expedite the remediation process when multiple assets are affected.
With bulk remediation, you can apply inventory actions in bulk to **all** assets in a specific filter:
* Google Drive or Workspace
* Box
{% hint style="success" %}
You can run up to 10 remediation actions in parallel, enabling you to remediate hundreds of thousands of assets at the same time. Scalable remediation is unique to DoControl, and allows you to address your remediation challenges more effectively and speedily.
{% endhint %}
Before starting to remediate, take a look at our overview of bulk remediation:
* [Remediation at-a-glance](#remediation-at-a-glance)
* [Effects of bulk remediation](#effects-of-bulk-remediation)
* [What are inherited permissions?](#what-are-inherited-permissions)
## Remediation at-a-glance
Bulk remediation at scale is unique to DoControl, especially the complete and transparent handling of assets with inherited permissions. This infographic explains the steps you need to perform when remediating assets in bulk.
1. **Filter assets** - Use filtering options to create a subset of problematic Google assets you wish to remediate.
2. **Assess and remediate** - When you choose the assess option before remediating, DoControl evaluates the assets and delivers an assessment report with a summary of the asset breakdown.
3. **Analyze report** - Drill-down into the asset summary by inspecting the CSV report.
4. **Refilter assets** - If too many asset candidates for remediation appear in the assessment report, you can refilter your assets.
5. **Just remediate** - Skip the assessment, and send assets directly to workflows for remediation.
6. **Remediate assets** - Choose the relevant option(s):
* **Explicit permissions** - Remediate only assets with explicit permissions that were granted to the file or folder.
* **Inherited permissions** - Remediate all assets that inherited permissions. This also remediates the parent folders and their child assets.
{% hint style="info" %}
* You can remediate up to **100,000** Google Drive permissions in a single bulk action. If you select assets with more permissions, DoControl remediates only the first 100,000.
* It can take a few minutes or several hours to remediate assets in bulk.
* The same process applies when remediating Google assets or external users.
{% endhint %}
## Effects of bulk remediation
Bulk remediation is mainly used in cases where you have a large permission gap you need to close quickly. It could involve a terminated employee, incident response, or just unused permissions in a backlog you haven't cleaned up yet.
When you remediate in bulk, you actually select assets that match your specific criteria via the Inventory filters. DoControl then assesses these assets to make sure that data is valid for remediation, and checks if there are any inherited permissions.
## Remediating archived users
DoControl uniquely allows you to remediate permissions of archived users in bulk, allowing you to easily clean up archived exposure backlogs.
Assets of archived users (Google users who were terminated) can be remediated directly through DoControl's regular bulk flows, eliminating the need for manual workarounds or un-archiving users.
## What are inherited permissions?
Inherited permissions are built into the folder structure of Google Shared and My drives.
Permissions for a shared folder propagate downward, with all child assets and folders inheriting permissions from the parent. Whenever permissions or the hierarchy is changed, the propagation occurs recursively through all nested folders.
### Removing permissions from Google shared drives
When it comes to remediating Google assets in shared drives, you need to consider assets that inherited their permissions from a parent folder.
Assets in shared drive folders sometimes inherit permissions from their parent folders. To remediate these assets with inherited permissions, you must also remediate the parent folders and all child assets, which are outside your original filtered scope.
DoControl sends you an assessment report listing all affected assets and folders before remediating them.
### Use case with inherited permissions
To help you better understand the implications of inherited permissions:
1. Let's say you want to remediate all assets with a sharing status that equals:\
`External` and `last modified before 01/01/2023.`
2. An asset called “file A” in a Google shared drive matches both these criteria. This asset inherited its permissions from a parent folder called “folder B.”
3. According to Google’s permission hierarchy, when you remediate “file A” you also remediate “folder B” as well.\
This means the sharing status will be removed from file A, as well as from all assets in folder B.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/workflows/bulk-remediation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
