IntermediateLesson 3 of 514 min
Add people to groups, not folders
Two kinds of groups, one nested in the other. Onboarding becomes a single click.
The model that keeps access clean for years uses two kinds of groups.
| Kind | Describes | Example | Who is inside |
|---|---|---|---|
| Role group | People | role-finance@ | The finance staff |
| Access group | A level of access to one drive | drv-finance-editor@ | Role groups, not people |
The five rules
- Step 1. Create a role group for each department or job function.
- Step 2. Create access groups for each shared drive, one per level you need. Manager, editor, viewer.
- Step 3. Put role groups inside access groups. Google Drive honors nested groups.
- Step 4. Put only access groups on shared drives.
- Step 5. Put people only in role groups.
Enter your own departments and see the full set of groups and shared drives to create.
Try it
Access model builder
List your departments. You get the groups and shared drives to create, already named.
| Shared drive | Access group on the drive | Drive role | Put inside the access group |
|---|---|---|---|
| FINANCE - Team | drv-finance-manager@yourcompany.com | Manager | role-finance-leads@yourcompany.com |
| drv-finance-editor@yourcompany.com | Content manager | role-finance@yourcompany.com | |
| drv-finance-viewer@yourcompany.com | Viewer | role-all-staff@yourcompany.com | |
| SALES - Team | drv-sales-manager@yourcompany.com | Manager | role-sales-leads@yourcompany.com |
| drv-sales-editor@yourcompany.com | Content manager | role-sales@yourcompany.com | |
| drv-sales-viewer@yourcompany.com | Viewer | role-all-staff@yourcompany.com | |
| OPERATIONS - Team | drv-operations-manager@yourcompany.com | Manager | role-operations-leads@yourcompany.com |
| drv-operations-editor@yourcompany.com | Content manager | role-operations@yourcompany.com | |
| drv-operations-viewer@yourcompany.com | Viewer | role-all-staff@yourcompany.com |
Role groups, where people go
- role-all-staff@yourcompany.com
- role-finance@yourcompany.com, role-finance-leads@yourcompany.com
- role-sales@yourcompany.com, role-sales-leads@yourcompany.com
- role-operations@yourcompany.com, role-operations-leads@yourcompany.com
A new hire in Finance
Add them to role-finance@yourcompany.com and role-all-staff@yourcompany.com. They can edit the Finance drive and read the others. Nobody touches a folder.
3 shared drives, about 16 groups
Each drive uses 3 of its 100 group slots and 3 of its 600 member slots. Create every group in the Admin console under Directory, Groups.
What this buys you
- Onboarding. Add the new hire to one role group. They get every drive that role reaches.
- Changing teams. Swap one role group for another.
- Offboarding. Remove the person from their groups. All shared drive access ends.
- Audits. To see who can open a drive, read the groups.
Naming
| Object | Pattern | Example |
|---|---|---|
| Role group | role-department | role-finance@ |
| Drive access group | drv-drive-level | drv-finance-viewer@ |
| Folder access group | fld-drive-folder-level | fld-hr-cases-editor@ |
| Policy group | cfg-service-setting | cfg-drive-external-allow@ |
| Outside partners | ext-partner-purpose | ext-acme-auditors@ |
| Shared drive | DEPT - Function | FINANCE - Operations |
Finished this lesson?
Facts checked November 12, 2026