Shared-drive permissions are easier to manage when administrators distinguish drive membership, access levels, direct file sharing, folder sharing, group membership, and organization-wide sharing settings.
Why Shared Drive Permissions Can Be Confusing
A person can receive access through direct shared-drive membership, Google Group membership, a directly shared file, a directly shared folder, an organization-wide link, or an external collaboration rule.
When administrators review only the member list, they may miss people who have access through groups or item-level sharing.
Drive Membership
A shared-drive member receives an access level that applies across the drive, subject to limited-access folders and other restrictions.
Membership is appropriate for people who need continuing access to a significant portion of the content.
Manager
Managers can control membership, change member access levels, rename the shared drive, change sharing restrictions, move folders between drives, permanently delete content from trash, and perform other high-impact actions.
Keep Manager access limited to trusted employees or administrators who are responsible for the entire drive.
Manager is an administrative role
Do not assign it only because someone is senior or needs to edit files. Use Content manager or Contributor when drive administration is not required.
Content Manager
Content managers can create, edit, organize, move, and delete content. They can manage files and, depending on restrictions, may share folders.
This role fits employees who maintain the folder structure and content but should not control drive membership or core settings.
Contributor
Contributors can create and edit files but have less ability to move or delete content. This role can reduce accidental removal risk.
In Google Drive for desktop and some ChromeOS file workflows, Contributor access may provide more limited behavior. Test the employee's actual tools.
Commenter
Commenters can view content and add comments where supported but cannot edit the underlying file.
This role fits reviewers, approvers, advisors, and external participants who provide feedback.
Viewer
Viewers can open and read files. They cannot edit or comment.
Managers may be able to restrict Viewers and Commenters from downloading, copying, or printing, but this does not prevent every method of capturing information.
Use the Minimum Role
Choose the lowest access level that supports the person's responsibilities. An employee who reads procedures does not need Contributor access.
Role decisions should be based on actions: view, comment, create, edit, organize, delete, share, or manage membership.
Ask what the person must do
Translate the approved business task into the minimum role instead of copying another employee's access.
Use Google Groups for Membership
Add role-based Google Groups as shared-drive members when a stable team needs the same access level.
This allows onboarding and offboarding through group membership. Assign group owners and review nested and external members.
Direct Individual Membership
Direct membership can be appropriate for temporary projects, external collaborators, senior employees with unique duties, or exceptions.
Record a sponsor, business reason, role, start date, and expiration date for exceptions.
Non-Member File Access
When organization and shared-drive settings allow it, members can share individual files with people who are not members of the drive.
This supports narrow collaboration but can create hidden access that does not appear in the shared-drive member list.
Non-Member Folder Access
Shared-drive folders can be shared with non-members when settings and access levels permit it.
Use this when collaborators need one project area rather than the entire shared drive. Review folder access separately from drive membership.
Limited-Access Folders
Where supported, Managers can mark a folder as limited access so only Managers and directly added people can open its contents.
Other shared-drive members may see the folder name but cannot open it. Use this carefully because it creates an exception to broad membership visibility.
When to Use a Separate Shared Drive
A separate shared drive is often clearer when content has a different business owner, retention requirement, external-sharing rule, sensitivity level, or membership population.
Do not rely on many limited-access folders to combine unrelated security zones inside one drive.
External Members
External people can be added as members when organization settings permit it and their email address is associated with an appropriate Google account.
Review the external organization, sponsor, contract, role, files, expiration, and offboarding procedure.
External Item Sharing
A file or folder can sometimes be shared with an external person without making them a shared-drive member.
This is usually better when the collaborator needs only a narrow area. Apply an expiration where supported and review continuing need.
Organization-Wide Access
Items may be available to anyone in the organization through a link or general-access setting.
Organization-wide access should still be intentional. Sensitive content should remain restricted to specific users or groups.
Public and Anyone-With-the-Link Access
Administrators can restrict whether users may publish content or share to anyone with a link.
A link is not a reliable identity control. Do not use public or unrestricted links for confidential business records.
Shared Drive Restrictions
Managers and administrators may control whether external people can access files, whether non-members can receive access, whether Content managers can share folders, and whether Viewers and Commenters can download, copy, or print.
Document these settings for every sensitive or externally used shared drive.
Administrator Sharing Settings
Google Workspace administrators set broader Drive sharing rules by organizational unit or supported configuration group.
A shared-drive setting cannot make access more permissive than the organization-level policy allows.
Permission Inheritance
Members normally receive access throughout the shared drive. Direct file and folder sharing can add access for non-members.
Limited-access folders can restrict visibility. When troubleshooting, review the entire path rather than only the file.
Moving Content and Permissions
Moving content into a shared drive can preserve some direct permissions but may not preserve all inherited access from the original location.
Validate the source and destination membership, direct users, groups, external access, and links before and after the move.
Access Requests
Requests for shared-drive membership generally go to Managers. File or folder access requests may go to the item's creator or a Manager depending on permissions.
Define who approves access and what evidence is required.
Review Effective Access
For each sensitive drive, review Managers, Content managers, Contributors, Commenters, Viewers, groups, nested members, external members, directly shared folders, directly shared files, limited-access folders, and organization-wide links.
Do not assume the drive member list is a complete access report.
Quarterly Permission Review
Confirm employment, contract status, job role, sponsor, access level, external need, group membership, expiration, and recent use.
Remove former employees, completed projects, abandoned vendors, duplicate direct access, and excessive roles.
Shared Drive Permission Checklist
- Use Manager only for drive administrators.
- Use Content manager for employees who organize content.
- Use Contributor for employees who create and edit with less deletion control.
- Use Commenter and Viewer for review-only needs.
- Use groups for stable role-based membership.
- Document direct individual exceptions.
- Review non-member file and folder sharing.
- Use limited-access folders sparingly.
- Control external users and links.
- Review organization and shared-drive restrictions.
- Validate permissions after moving content.
- Complete quarterly effective-access reviews.
Frequently Asked Questions
What is the difference between Content manager and Contributor?
Content managers can organize and delete content more broadly, while Contributors focus on creating and editing with less control over structure and removal.
Can a person access one folder without joining the shared drive?
Yes, when folder sharing is allowed. This should be reviewed as non-member access.
Can a shared-drive member be blocked from one folder?
Where limited-access folders are supported, Managers can restrict a folder to directly added people and Managers.
When Professional Support Helps
Professional support can map effective access, correct roles, design groups, control external sharing, validate limited-access folders, and establish recurring permission reviews.
Need help applying this?
Organize Google Workspace Drive with confidence.
J3 Systems Group LLC can design shared drives, organize folders, configure permissions and external sharing, migrate files, review access, and document Drive administration procedures.