> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/bulk-remediation/apply-a-bulk-action/assess-and-remediate.md).

# Assess and remediate

When you assess inventory items, DoControl evaluates which Google assets are valid for remediation, and uses a unique algorithm to recursively iterate and scan the entire file system hierarchy. Running an assessment of your selected inventory items before remediating gives you a better understanding of the magnitude and scope of permissions you're about to remediate.

The business impact is especially relevant for inherited permissions in Google shared drives. Shared drives always inherit permissions from their parent folders. When remediating assets with inherited permissions, you also remediate the parent folders and all child assets, which are outside your original filtered scope.

{% hint style="warning" %}

* You can run up to 10 assessments at a time.
* It can take a few minutes or up to a few hours to complete an assessment, depending on the number of assets or users selected.
  {% endhint %}

## What's remediated?

[Inherited permissions](/docontrol-user-guide/workflows/bulk-remediation.md#what-are-inherited-permissions) are built into the folder structure of Google shared drives. When remediating assets, you can select one of these permission types:

* **Explicit permissions** - These permissions are applied directly to the file or folder. 
* **Inherited permissions** - These permissions are taken from their parent folders. When you remediate assets with inherited permissions, you also remediate all parent folders and child assets, which are outside your remediation scope.

Depending on the permission type you select to remediate, these assets will be remediated:

<table><thead><tr><th width="381">Remediation action</th><th>What will be remediated?</th></tr></thead><tbody><tr><td><strong>Remove external collaborators</strong></td><td>Any user permissions outside your company domain will be removed from selected assets</td></tr><tr><td>Explicit collaborators</td><td>External user permissions that were given directly to the file or folder will be removed from selected assets </td></tr><tr><td>Inherited collaborators from a parent folder</td><td>External user permissions will be removed from all parent folders and child assets, which are outside your remediation scope</td></tr><tr><td><strong>Remove public sharing</strong> </td><td> The “Anyone with the link” permission will be removed from selected assets</td></tr><tr><td>Explicit links</td><td>Publicly shared links that were applied directly to the file or folder will be removed from selected assets</td></tr><tr><td>Inherited links from a parent folder </td><td>Publicly shared links will be removed from all parent folders and child assets, which are outside your remediation scope</td></tr><tr><td><strong>Remove org-wide sharing</strong> </td><td>The organization-wide access permission will be removed from selected assets</td></tr><tr><td>Explicit links</td><td>Org-wide links that were applied directly to the file or folder will be removed from selected assets</td></tr><tr><td>Inherited links from a parent folder </td><td>Org-wide links will be removed from all parent folders and child assets, which are outside your remediation scope</td></tr><tr><td><strong>Change asset owner</strong></td><td>Assets in a specific user's My Drive will be transferred to another user's My Drive. This action is not relevant for shared drive assets.</td></tr><tr><td><strong>Remove permissions</strong></td><td>Selected external user permissions will be removed from <strong>all</strong> assets. Internal collaborators and asset owners will still have access.</td></tr></tbody></table>

## Start assessment

1. Select **Inventory > Assets > Google Drive.**
2. Apply relevant filters according to what you want to remediate. For example, filter files according to:
   * Files owned by specific users
   * Files shared with a specific collaborator domain (such as gmail)
   * Files with different sharing statuses (such as external, public)<br>

     <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FEMRCJxnFarDjgRx6mDz8%2Fbulk%20filters.png?alt=media&amp;token=58630efc-2761-4aff-90d2-29131ef9b283" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}

* You need to select at least one Google Drive asset to remediate.
* You can select any number of Google Drive assets, but DoControl will only remediate the first **100,000** permissions with a bulk action.
* **Archived** Google users cannot be included in bulk remediation actions, and are indicated as invalid.
  {% endhint %}

3. Select the relevant items to remediate.
4. Select the relevant remediation action:
   * [Remove public sharing](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-public-sharing) - The “Anyone with the link” permission will be removed from selected assets
   * [Remove external collaborators](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-external-collaborators) - All or specific user permissions outside your company domain will be removed from assets
   * [Change owner](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#change-owner) - Assets in a specific user's My Drive will be transferred to another user's My Drive. This action is not relevant for shared drive assets.
   * [Remove org-wide sharing](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-org-wide-sharing) - The organization-wide access permission will be removed from selected assets<br>

     <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fo74Jssc3fTE0f83jqVph%2Fremediation%20bar.png?alt=media&amp;token=efa3deb0-30e6-4745-bd37-9eabb2c688a3" alt=""><figcaption></figcaption></figure>
5. Select **Assess and remediate** and click **Start**.\
   The assessment might take a few minutes or hours to complete.<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FVEM8DfJj8vEX98kmIG9w%2Fremediate%20assess%20new.png?alt=media&amp;token=caf01a93-dc99-418e-b406-f0845db49257" alt=""><figcaption></figcaption></figure></div>
6. Once the assessment is complete, check your inbox for a report from DoControl: **Google Drive remediation assessment report is ready**. <br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FgpzqOm4WB8vgKnZu1zDN%2Fassess%20report.png?alt=media&amp;token=e9cc7669-95cb-4589-a0f6-d3deeb64d88f" alt=""><figcaption><p>Assessment report: DoControl provides full visibility in handling assets with inherited permissions</p></figcaption></figure></div>

The assessment report gives you a breakdown of the number of affected asset numbers and their permission types that are about to be remediated:

* **Valid assets** - These assets can be remediated.
* **Invalid assets** - These assets can't be remediated possibly because the asset, collaborator or link no longer exists.

{% hint style="info" %}
To understand the explicit or inherited permission types that will be remediated, see [What's remediated? ](#whats-remediated)
{% endhint %}

7. Click **View Results and Remediate**. The remediation assessment with your asset breakdown opens in DoControl:<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FZoAbEkJemIW3OzJ6pkSb%2FAssess%20report1.png?alt=media&amp;token=62ed64a6-5903-4d16-87a3-e78f61a95774" alt=""><figcaption></figcaption></figure></div>
8. Click **Download report** to view the assessment report details as a CSV file.
9. Select the collaborator or link type to remove:&#x20;
   * **Explicit** - These assets have directly applied collaborators or sharing links.
   * **Inherited** - These assets have inherited collaborators or sharing links from their parent folders. If you remediate inherited permissions, you might also remediate collaborators or links in parent folders and child assets, which are outside of your remediation scope.
10. Select the relevant workflow to run for this remediation action.
11. Click **Remediate,** or **Abort** to cancel the remediation and refine your asset selection.<br>

    <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FkavMTwFqMvlzSxKeVvom%2FRemediation%20about%20to%20start.png?alt=media&amp;token=995d2cd8-d391-49f1-965e-4dad321446b5" alt=""><figcaption></figcaption></figure></div>
12. Click **View remediations** to see when the remediation is complete, as indicated by the **Remediation completed** status.
13. Click **View execution** to see the details of the workflow activity and outcome of the remediation action.<br>

    <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FqS8Cn4Zt49xwsfoXPt0U%2Fworkflow%20acivity%20bulk.png?alt=media&amp;token=0136f55b-7768-4ff5-8c43-a192bbf2045d" alt=""><figcaption></figcaption></figure>

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><ul><li>It might take a few minutes or hours based on the number of assets for the inventory to refresh, and for the remediated permissions to be removed from the DoControl inventory.</li><li>Click <a href="/docontrol-user-guide/workflows/bulk-remediation/apply-a-bulk-action/view-remediations-and-assessments.md">View remediations</a> to see all your recent and in-progress remediations.</li></ul></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/workflows/bulk-remediation/apply-a-bulk-action/assess-and-remediate.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.