# Google Drive

> Connect Google Drive to LightHouse: the ways to connect, the read-only scopes, where the credential is held, and what is indexed.

**Built in the engine.** The engine reads the Google Drive folders and shared drives you name.

## The ways to connect

- **In LightHouse**: In LightHouse, the card for this connector says your engineer configures it in your deployment; it cannot be connected from LightHouse yet \[Coming]. It connects in code.
- **From a terminal**: \[Coming]
- **In code**: below.

## Connect in code

The engine takes an OAuth **access token** with the `drive.readonly` scope, from the environment variable `GDRIVE_TOKEN`. It holds no refresh token: minting a fresh access token is your platform’s job, for example a service account with domain-wide delegation, or workload identity federation.

```yaml
- id: drive-policies
  purpose: Read the policy folders into the knowledge base.
  executor: python
  target: aal_engine.ingest.connector:run_card
  overseer: ops@example.com
  budget_usd: 0
  effect: internal
  source:
    kind: gdrive
    folders: [<folder id>]
    drives: []                    # shared drive IDs, if any
    label: standard
    requires:
      reads: [Docs, Sheets, Slides and text files in the policy folders]
      reason: the HR agents answer from the current policies
```

Name folders, shared drives, or both; at least one is required.

## Scopes

| Scope                                            | Why                                        |
| ------------------------------------------------ | ------------------------------------------ |
| `https://www.googleapis.com/auth/drive.readonly` | List, export and download files. Read only |

The engine calls, all `GET` on `www.googleapis.com`: `/drive/v3/files` (including shared drives), `/drive/v3/changes` and its start token, `/drive/v3/files/{id}/export` and `/drive/v3/files/{id}?alt=media`.

## Where the credential is held

In your own account. Whatever mints the access token (a service account key in your secret store, or federation) stays there; the engine sees only a short-lived token in `GDRIVE_TOKEN`.

## What is indexed

| File                         | How it is read                    |
| ---------------------------- | --------------------------------- |
| Google Docs and Slides       | Exported as plain text            |
| Google Sheets                | Exported as CSV (the first sheet) |
| Text, Markdown and CSV files | Downloaded as they are            |

**Never read:** anything else, including PDFs, images and archives. They are skipped and counted in the log.

**How often:** on the card’s schedule. Each pull reads Drive’s change feed since the last one. A file deleted, trashed or moved out of the folders is removed from the corpus.

## Check it worked

- The source’s run note: `written N, unchanged N, quarantined N, removed N`.
- **Agents → Knowledge**: documents from `gdrive`.

## Removing it

Remove the card, and revoke the service account’s delegation or the federation grant in Google. Documents already written stay in the corpus until you delete them.

Source: https://docs.atlanticagenticlabs.com/connect/google-drive/