Google Drive

Built in the engine. The engine reads the Google Drive folders and shared drives you name.

The ways to connect

• In LightHouse: In LightHouse, the card for this connector says your engineer configures it in your deployment; it cannot be connected from LightHouse yet Coming. It connects in code.
• From a terminal: Coming
• In code: below.

Connect in code

The engine takes an OAuth access token with the drive.readonly scope, from the environment variable GDRIVE_TOKEN. It holds no refresh token: minting a fresh access token is your platform’s job, for example a service account with domain-wide delegation, or workload identity federation.

- id: drive-policies
  purpose: Read the policy folders into the knowledge base.
  executor: python
  target: aal_engine.ingest.connector:run_card
  overseer: ops@example.com
  budget_usd: 0
  effect: internal
  source:
    kind: gdrive
    folders: [<folder id>]
    drives: []                    # shared drive IDs, if any
    label: standard
    requires:
      reads: [Docs, Sheets, Slides and text files in the policy folders]
      reason: the HR agents answer from the current policies

Name folders, shared drives, or both; at least one is required.

Scopes

Scope	Why
https://www.googleapis.com/auth/drive.readonly	List, export and download files. Read only

The engine calls, all GET on www.googleapis.com: /drive/v3/files (including shared drives), /drive/v3/changes and its start token, /drive/v3/files/{id}/export and /drive/v3/files/{id}?alt=media.

Where the credential is held

In your own account. Whatever mints the access token (a service account key in your secret store, or federation) stays there; the engine sees only a short-lived token in GDRIVE_TOKEN.

What is indexed

File	How it is read
Google Docs and Slides	Exported as plain text
Google Sheets	Exported as CSV (the first sheet)
Text, Markdown and CSV files	Downloaded as they are

Never read: anything else, including PDFs, images and archives. They are skipped and counted in the log.

How often: on the card’s schedule. Each pull reads Drive’s change feed since the last one. A file deleted, trashed or moved out of the folders is removed from the corpus.

Check it worked

• The source’s run note: written N, unchanged N, quarantined N, removed N.
• Agents → Knowledge: documents from gdrive.

Removing it

Remove the card, and revoke the service account’s delegation or the federation grant in Google. Documents already written stay in the corpus until you delete them.