Workspace Studio enables users to boost their productivity with custom, no-code agentic automation. Today, we are adding a new set of enterprise security controls to enable additional collaboration use cases. These granular identity, data protection, observability, and governance controls provide admins with more confidence to safely enable and adopt agentic capabilities in their organization.
Built-in, enterprise security controls in Workspace Studio include:
- Agent identities
- Agent access management
- Agent auditing and observability
- Admin settings / human-in-the-loop (HiTL)
- Runtime protections
Collaboration use cases
When Studio initially launched, it was only able to assist users in their tasks, such as drafting an email, not executing tasks autonomously, such as sending an email. Now, Studio supports cross-user collaboration through the introduction of several new steps with built-in guardrails.
 |
| Collaboration actions in Studio Flows |
Agent identities: Automation with flows in Studio will continue to run with the user’s identity, but in a least-privileged way. This means that the flow will have the minimal set of privileges required to run, and not the full set of privileges the owner has. When the flow executes, it will do so with a unique, auditable identifier. Note: the least-privilege agent identity will apply to newly created flows only. Existing flows will be supported in the future.
(Beta) Identity attribution: Admins, through a new setting, will be able to decide whether the actions taken by a flow show the owner's identity, or are attributed to the flow itself, with the owner information made visible. This will default to “on”; meaning the actions by the flow will be attributed to the flow. Note: the agent identity attribution setting will apply to newly created flows only. Existing flows will be supported in the future.
 |
| Flow represented as the owner's identity |
 |
| "
Flow attributed as the flow’s name with owner’s information |
Auditing and observability: Actions in Studio across configuration and execution events are recorded in Studio audit events. Additionally, audit events for actions, such as edits made to a file in Drive or emails sent in Gmail, will include flow context, such as a unique flow identifier and the owner’s information. Note: agent context in audit logs will apply to newly created flows only. Existing flows will be supported in the future.
Agent access management: In the admin console, an Agent access management dashboard gives admins the ability to suspend all flows or targeted OAuth scopes for individual flows, such as revoking Drive access. Additionally, the security investigation tool enables admins to transition directly from an audit event to the agent access management page, facilitating swift remediation during incident investigations. Note: after the rollout, newly created flows will be shown in Agent access management. Existing flows will be supported in the future.
 |
Agent access management dashboard |
Admin settings & human-in-the-loop: Additional admin settings will support disabling specific step types for flows, disabling Gemini data access, enforcing end-user confirmation for steps that share data externally, and disabling webhook integrations.
 |
Flow asking for human approval before it sends an email externally |
Runtime protections: Additional data loss prevention (DLP) features for Gemini data access and Studio flows are available for added protection. Gemini DLP restricts Gemini’s ability to access Drive data based on content conditions and labels, with support for additional services coming soon. Agent DLP will support restrictions on Studio flow execution, including blocking or enforcing end-user review, based on conditions of the sourced data, utilized data, and data visibility of the output.
 |
Studio DLP |
Rollout pace
Admin console settings
End-user visible features
(Beta) Identity attribution
Getting started
Availability
Available for Google Workspace*:
- Business Starter, Standard, and Plus
- Enterprise Starter, Standard, and Plus
- Education Fundamentals, Standard, and Plus
Also available to*:
- Google AI Pro for Education
- Google AI Ultra for Business
* Gemini DLP, and DLP for Studio are available only for Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus
