> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/box-remediation.md).

# Box remediation

DoControl provides your organization with an automated way to detect and prevent unnecessary or dangerous exposure on Box. 

Using the following remediation actions, you can implement automated workflows across Box permissions and assets:

* [Remove collaborator](#remove-collaborator)
* [Remove shared links](#remove-shared-links)
* [Add collaborator](#add-collaborator)

## Remove collaborator

You can remove collaborator access from a Box file for one or more collaborators. When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. 

Use cases for the Remove collaborator remediation action include:

* If a collaborator is a former employee
* If a file contains personally identifiable information (PII) and the collaborator is external

1. In Workflows, select **New workflow > From scratch** or **Playbooks**.
2. Give an action name and select the **Box > Change user access** event.
3. Define the relevant conditions, for example, that the `target email` is not in a trusted domain.
4. From the Actions pane, select **Remediate > Box > Remove collaborator.** The external user access is automatically removed from the Box asset.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F6uXlNv2C0rVTAoJQsxaW%2FBox%20remove%20collaborator.png?alt=media&amp;token=11d4969d-bb1a-4d01-bb07-d9a9a4db927c" alt=""><figcaption><p>Define a workflow to remove a collaborator from Box</p></figcaption></figure>

## Remove shared links

You can define a workflow to remove shared links from Box assets. Using a remediation action, users can choose if they want to remove public sharing links, team folder sharing links, or all sharing links.

This allows your organization's security team to control asset exposure, and track individuals who change the sharing link visibility from internal to public.

#### To remove shared links from Box:

1. In your workflow, define a trigger related to Box.
2. From the Actions pane, select **Remediate > Box > Remove shared links**.
3. Drag the action into the canvas and connect it to the previous action.
4. For `asset ID`, use the default macro or type your own query.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FgcpzKmOFwBGh0K1V1ynD%2FBox%20remove%20shared%20link.png?alt=media&amp;token=60006cd0-ec67-4bce-9c0a-db11399f3f59" alt=""><figcaption><p>Define a workflow to remove shared links from a Box asset</p></figcaption></figure>

## Add collaborator

You can remove collaborator access automatically from a Box asset for one or more collaborators, and restore access only after the collaborator is approved. A collaborator is any user besides the owner who has access to a Box asset.

The benefit of removing collaborator access immediately from a Box file is that your organizational workflow is not dependent on receiving approval from the relevant party before blocking file access. In this way, you protect your Box assets by isolating them and not sharing them indefinitely with collaborators as you wait for approval.

When an asset exists in a parent folder, collaborator access is removed from all assets in the folder.

{% hint style="info" %}
For example:

* If an employee is on vacation or leaves the company, the workflow allows you to block asset access first, and receive approval later. Once the collaborator is approved, the workflow automatically adds the collaborator to the Box file and restores access.
* If a user wants to add a permission as a result of changes to Okta permissions or HR roles.&#x20;
  {% endhint %}

**To add a collaborator to a Box asset:**

1. In Workflows, select **New workflow > From scratch** or **Playbooks**.

2. Give an action name and select the **Box > Share** event.

3. Define the relevant conditions, for example, that the `Get collaborators` macro includes a specific user.

4. From the Actions pane, select **Remediate > Box > Remove collaborator.** The file is isolated until permission is granted to the collaborator by the security team.

5. Add an **Approval** step.

6. For the **Yes** branch (the collaborator is approved), add the **Remediate > Box > Add collaborator** step. Enter these fields:

   * **Asset ID** - `Get asset ID` macro from previous steps or event.
   * **Collaborator** - `Get collaborators` macro. Email can be taken from previous steps or the event:
   * **Role** - Select the relevant role: Editor, viewer, previewer, uploader. Or use the `Get collaborator role` macro from the event.
   * **Expiration time** (optional) - Dynamic or static

   File access is then restored to the collaborator.

7. For the **No** and **Timeout** branches (the collaborator is not approved), add the **End workflow** step.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FChHdOSkX1wcPTbe7zsqN%2FBox%20add%20collaborator.png?alt=media&amp;token=a504e69b-918d-426c-a0f9-2a1d7aff1f49" alt=""><figcaption><p>Define a workflow to restore a collaborator to an isolated Box asset only after approval </p></figcaption></figure>

{% hint style="info" %}

* Note you can only add a single collaborator to a Box asset.
* You cannot add a group as a collaborator.&#x20;
* The expiration date is available only in specific enterprise plans of Box when this feature is enabled in Box settings. For more info, see [Box documentation](https://developer.box.com/reference/post-collaborations).
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/box-remediation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.