Configure Access Management and Access Approvals policies using classification labels with rules in Assured Controls

We’re introducing Assured Controls rules in the Google Workspace Admin Console, giving administrators a more granular, resource-centric way to enforce Access Management and Access Approvals policies on Google Drive files.

Previously, Access Management and Access Approvals policies could only be scoped at the user level, applying broadly to all covered data owned by users within a selected Organizational Unit (OU) or group. With Assured Controls rules, admins can now configure both Access Management and Access Approvals policies together in a single unified rule and target specific Google Drive files using classification labels in addition to existing OU and group-based scoping capabilities.

By scoping Assured Controls policies to specific classification labels, organizations can reserve their strictest sovereign and compliance controls for only their most sensitive files while maintaining standard, rapid support workflows for less sensitive business data.

How organizations can use Assured Controls rules:

• Automated end-to-end protection with Data Loss Prevention (DLP): Admins can combine data protection rules with Assured Controls rules to automatically apply Access Approvals and Access Management policies based on Drive file contents. A DLP rule can automatically apply a classification label when sensitive content (such as Personally Identifiable Information, financial records, or regulated project identifiers) is detected in a Drive file, which then automatically triggers the corresponding Assured Controls rule using that label as a condition to enforce Access Management and Access Approvals protections.
• Regional data sovereignty across multinational teams: Multinational enterprises can apply regional classification labels (such as EU Restricted or U.S. Restricted) to Drive files and restrict access to EU or US support staff based on the contents of the file itself.
• Targeted compliance for regulated workloads: Public sector and financial services organizations can apply a classification label (such as CJIS / IRS 1075) to sensitive Drive files and use an Assured Controls rule to restrict support actions on those files to CJIS-authorized and IRS 1075-authorized individuals while simultaneously requiring explicit Access Approvals—without impacting support speed for unclassified files owned by the same users.

Getting started

• Admins: Use our Help Center to learn more about Assured Controls rules for Access Management & Access Approvals.
• End users: There is no end user setting for this feature.

Rollout pace

• Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) started on September 30, 2026

Availability

• Access Approvals rule-based enforcement: Available to Google Workspace Enterprise Plus and Frontline Plus customers with the Assured Controls or Assured Controls Plus add-on.
• Access Management rule-based enforcement: Available to Google Workspace Enterprise Plus and Frontline Plus customers with the Assured Controls Plus add on.

Resources

• Google Workspace Admin Help: Assured Controls rules for Access Management & Access Approvals 
• Google Workspace Admin Help: Access Management: Limit the Google staff who can take support actions related to your data
• Google Workspace Admin Help: Access Approvals: Require Google staff to request approval before viewing support data
• Google Workspace Admin Help: About Assured Controls and Assured Controls Plus
• Google Workspace Admin Help: What data is covered by Access Management and Access Approvals? 
• Google Workspace Admin Help: Create data protection rules
• Google Workspace Admin Help: Create classification labels for your organization