Configure Access Management and Access Approvals policies

Configure Access Management and Access Approvals policies using classification labels with rules in Assured Controls

Google introducing Assured Controls rules in the Google Workspace Admin Console, giving administrators a more granular, resource-centric way to enforce Access Management and Access Approvals policies on Google Drive files.

Previously, Access Management and Access Approvals policies could only be scoped at the user level, applying broadly to all covered data owned by users within a selected Organizational Unit (OU) or group. With Assured Controls rules, admins can now configure both Access Management and Access Approvals policies together in a single unified rule and target specific Google Drive files using classification labels in addition to existing OU and group-based scoping capabilities.

By scoping Assured Controls policies to specific classification labels, organizations can reserve their strictest sovereign and compliance controls for only their most sensitive files while maintaining standard, rapid support workflows for less sensitive business data.

How organizations can use Assured Controls rules:

Automated end-to-end protection with Data Loss Prevention (DLP): Admins can combine data protection rules with Assured Controls rules to automatically apply Access Approvals and Access Management policies based on Drive file contents. A DLP rule can automatically apply a classification label when sensitive content (such as Personally Identifiable Information, financial records, or regulated project identifiers) is detected in a Drive file, which then automatically triggers the corresponding Assured Controls rule using that label as a condition to enforce Access Management and Access Approvals protections.
Regional data sovereignty across multinational teams: Multinational enterprises can apply regional classification labels (such as EU Restricted or U.S. Restricted) to Drive files and restrict access to EU or US support staff based on the contents of the file itself.
Targeted compliance for regulated workloads: Public sector and financial services organizations can apply a classification label (such as CJIS / IRS 1075) to sensitive Drive files and use an Assured Controls rule to restrict support actions on those files to CJIS-authorized and IRS 1075-authorized individuals while simultaneously requiring explicit Access Approvals—without impacting support speed for unclassified files owned by the same users.

Getting started

Admins: Use our Help Center to learn more about Assured Controls rules for Access Management & Access Approvals.
End users: There is no end user setting for this feature.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) started on September 30, 2026

Availability

Access Approvals rule-based enforcement: Available to Google Workspace Enterprise Plus and Frontline Plus customers with the Assured Controls or Assured Controls Plus add-on.
Access Management rule-based enforcement: Available to Google Workspace Enterprise Plus and Frontline Plus customers with the Assured Controls Plus add on.

Resources

Google Workspace Admin Help: Assured Controls rules for Access Management & Access Approvals
Google Workspace Admin Help: Access Management: Limit the Google staff who can take support actions related to your data
Google Workspace Admin Help: Access Approvals: Require Google staff to request approval before viewing support data
Google Workspace Admin Help: About Assured Controls and Assured Controls Plus
Google Workspace Admin Help: What data is covered by Access Management and Access Approvals?
Google Workspace Admin Help: Create data protection rules
Google Workspace Admin Help: Create classification labels for your organization

To configure Access Management and Access Approvals policies together using data classification labels, you must use the Assured Controls rules wizard inside the Google Workspace Admin Console. This allows you to enforce resource-centric, granular compliance policies on specific Google Drive files based on their applied sensitivity labels, rather than managing them solely via user organizational units (OUs) or groups. [1, 2]

Prerequisites & Licensing Requirements

Access Approvals Rule: Requires either the Google Workspace Assured Controls or Assured Controls Plus add-on.
Access Management Rule: Requires the Google Workspace Assured Controls Plus add-on.
Admin Privileges: You must be signed in as a Super Administrator.
Classification Labels: You must already have created and published the relevant data labels in the Label Manager. [1, 2, 3]

Step-by-Step Configuration Guide

Navigate to Access Management:
Log in to the Google Admin Console, open the left hand Menu, and navigate to Data ➔ Compliance ➔ Access Management. [1]
Open the Rules Wizard:
Under the Rule-based scoping section, click on Assured Controls rules to open the dedicated setup wizard. [1]
Define Rule Criteria (Classification Labels):
Within the setup wizard, select Data Classification Labels as your primary targeting scope. Pick the specific label or badge option (e.g., Highly Confidential, Sovereign Restricted) that you want to apply this rule to. You can also layer standard OU and group restrictions if needed. [1, 2, 3]
Configure Access Management Policies:
Select the location and credential requirements that Google personnel must meet before they can fulfill support requests related to files carrying that label. [1, 2]
Configure Access Approvals Policies:
Toggle on the requirement for Google staff to request and receive explicit permission from your designated authorized personnel before accessing any data linked to that classification label. [1, 2]
Review and Save:
Verify the combination of both policies in your unified rule layout and click Save / Finish. [1, 2]

Would you like assistance setting up the automatic application of these classification labels using Data Loss Prevention (DLP) rules, or should we look at how policy conflicts are resolved when multiple rules overlap?