# Google Drive > Google Drive: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the documents in the Google Drive folders and shared drives you name, so agents can answer from the team’s working documents. It follows Drive’s change feed, so only what changed is read, and what the owner withdraws is withdrawn from the knowledge base. ## At a glance | Collector | Google Drive, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------------- | | Reads | Google: Google Drive ([the vendor's documentation](https://developers.google.com/drive/api/guides/about-sdk)) | | Family | Storage | | Kind | Files | | Ways to connect | Service account, OAuth approval | | Scopes | - Read: `https://www.googleapis.com/auth/drive.readonly` | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Content, Identity | | Hosts it may contact | `www.googleapis.com` | | Vendor API versions | Google Drive API v3 | | Lowest engine version | `0.45.0` | ## What it reads - Everything beneath the folders you name (`folders`, by folder id) and the whole of the shared drives you name (`drives`). - Google Docs and Slides, exported as plain text; Google Sheets, exported as CSV (Drive exports the first sheet only); plain text, Markdown and CSV files, downloaded as they are. - Anything else (images, PDFs, archives) is skipped and counted in the log, not refused by name: a shared drive always holds an image, and refusing it would stop every document in the drive from being read. - The cursor is Drive’s changes page token, kept with the ids in scope. A file deleted, trashed or moved out of scope becomes a withdrawal. If a folder leaves scope, the whole scope is read again, which costs nothing for unchanged files. ## How to connect 1. Create a service account for LightHouse’s reading, or use the account your platform already mints tokens with. 2. Share the folders or shared drives with the service account’s address, or, to read a personal Drive, grant the service account domain-wide delegation for `https://www.googleapis.com/auth/drive.readonly` and nothing broader. 3. In LightHouse, open **Connectors**, choose **Google Drive**, name the folders or shared drives, the label and how often to read, and attach the service-account key. Where your deployment keeps credentials in your own store, the key is sealed in your browser and LightHouse never sees it. 4. In code, give the deployment an OAuth access token with the `drive.readonly` scope as `GDRIVE_TOKEN` (minting and refreshing it is your platform’s job; the collector holds no refresh token) and add a `kind: gdrive` source card with `folders` and/or `drives`, `label` and `requires`. ## Permissions `https://www.googleapis.com/auth/drive.readonly` only. The collector sends only `GET` requests to `www.googleapis.com`: `/drive/v3/files` (including shared drives), `/drive/v3/changes` and its start token, `/drive/v3/files/{id}/export` and `/drive/v3/files/{id}?alt=media`. It never writes, even when the connection is made with a wider scope. Its read-only test proves it on every change. ## Limits - You must name folders or shared drives; a whole Drive is never the default. Ids are letters, digits, `_` and `-`. - Sheets export only their first sheet. - Files of other types are skipped and counted, not read. - The access token lasts about an hour; a long pull needs a platform that mints a fresh one for each run. ## Data handling - Document text is copied into the deployment’s corpus under the source’s `label`. Documents can name people and hold personal data of any kind. - The token stays in your secret store, is never written to logs or run notes, and is sent only to Google. The engine holds no refresh token, so a leaked run directory holds nothing that outlives the hour. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------- | | `name the folders or shared drives to sync; a whole Drive is never the default` | Neither `folders` nor `drives` is set | Name them by id | | `not Drive ids` | A folder or drive id has characters other than letters, digits, `_` and `-` | Copy the id from the folder’s address | | `credential variable 'GDRIVE_TOKEN' is not set` | No access token in the environment | Mint a token with the `drive.readonly` scope and set it | | `HTTP 401` | The one-hour token has expired | Mint a fresh token for each run | | `HTTP 403` or `HTTP 404` on a folder | The service account has no access to the folder | Share the folder with the service account | | Read succeeded, 0 written | Nothing changed since the last page token | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.45.0` | Google Drive API v3 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/gdrive/