AppControler
Start scan

What drive.readonly actually means (and why IT managers miss it)

drive.readonly lets an app read every file a person can open in Google Drive. drive also lets it edit and delete them. Here is how to tell them apart in Google Admin, and what to check first.

4 min read

Read the full article as text

Select any line, then press Ctrl+C — it stays on the page and lands in the clover.

The full article

Key points

  • A "Sign in with Google" grant needs no install and never touches the company network. It lives in Google Workspace.
  • drive.readonly can read every file the person can open in Drive, not just a few.
  • drive adds edit and delete on top of read.
  • Google Admin lists third-party apps and their scopes but does not translate them into plain English.
  • Ask the person who connected an app before you revoke it.

A policy is not an inventory

Most IT teams treat unapproved AI tools as a policy problem: write a rule, send it out, move on. By the time the policy exists, people have already connected tools with "Sign in with Google."

A policy tells people what they should do. It does not tell you what is already connected.

Where the grant actually lives

Nothing was installed on a laptop, and nothing passed through the company network. When someone clicks Allow on a Google consent screen, the grant is stored in your Google Workspace directory, so endpoint and network tools never see it.

What Google Admin shows, and what it leaves out

The raw list is already in the Admin console: Security → Access and data control → API controls → Manage Third-Party App Access.

That page shows which apps have access and which scopes they were granted. It does not tell you what a scope string means for your company's files, mail, or calendars.

drive.readonly and drive look like cousins

On a consent screen the two scopes read almost the same. One lets the app read company files. The other lets it edit and delete them.

drive.readonly is not a small permission

drive.readonly lets an app read and download every file the person can open in Google Drive. For most employees that includes shared drives and documents other teams shared with them. "Read-only" limits what the app can change, not how much it can see.

drive means read and write

The full drive scope adds edit and delete to everything above. An app with this scope can change or remove any file the person can open.

What to do tomorrow morning

Start small. You do not need a full audit to make progress.

  1. Open the third-party app list in Google Admin and pick one app you do not recognize.
  2. Read its scopes in plain English: what can it read, and what can it change?
  3. If it is an AI tool with broad Drive or Gmail access, ask the person who connected it whether they still use it — before you revoke anything.

You cannot approve what you cannot see

The data is already in Google Admin. Knowing what it means, and keeping that current as new apps get connected every week, is the hard part.

Related reading

Want the full list without walking Admin app by app?

AppControler runs one read-only Google Workspace scan, translates every scope into plain English, and separates out the AI tools.

Start a free Google Workspace scan