What Can a Google Drive AI Agent Change? A 77-Action Review

A Google Drive-connected AI agent can do much more than find a document. The current integration surface can search file names and metadata, download or export content, inspect permissions and comments, upload or edit files, change sharing, move items, empty trash, and permanently delete files or owned descendants in a folder.

In a bounded review of Aident Loadout's staging catalog on September 21, 2026, the exact Google Drive Action contract contained 77 public Actions. Twenty-nine had read-oriented names such as find, get, list, download, or export; 48 had names that more clearly add, create, delete, edit, move, patch, trash, update, upload, or watch.

The catalog search reported 78 matching hits while the exact Action enum contained 77 public methods. Treat that one-record difference as a reason to rediscover the contract, not as permission to round up or assume the inventory is permanent.

The safest first test is much smaller:

1. select the intended Google account;

2. search only the root of My Drive;

3. return at most five non-trashed items;

4. request only ID, name, and MIME type; and

5. stop before reading content, permissions, comments, shared drives, or file bodies.

If that is the boundary you need, inspect the current Google Drive integration in Aident Loadout before connecting an account. A working OAuth connection proves that a credential exists. It does not grant an agent a standing role across every file the user can reach.

The 77-Action Review

Four exact schemas were inspected in this review. Each was risk level 2 in the wrapper metadata. The file-search schema was especially instructive: if the corpus fields are omitted, its defaults can search My Drive plus all accessible shared drives and return substantially more metadata than a name-only lookup needs.

Names and coarse labels are useful warnings, but the exact input determines the real boundary.

A search can widen from one folder to every accessible drive

The reviewed file-search contract accepts a Drive query, folder ID, corpus, fields selector, page size, sort order, shared-drive flags, and a page token. Its default corpus was allDrives, with shared-drive support enabled.

That is convenient for broad discovery and wrong for a connection test. A request for "recent files" without an explicit root folder and user corpus can cross from personal My Drive into shared drives the connected person can access. A broad fields selector can add parents, permissions, links, labels, timestamps, sizes, or capabilities that the task never required.

Treat all of these as permission inputs:

• the connected account;

• My Drive, one shared drive, a domain corpus, or all drives;

• the exact folder or parent;

• the query and date boundary;

• the returned fields;

• the page size and page count; and

• whether content, metadata, comments, permissions, or links may leave Google Drive.

Download and export cross a data boundary

Download and export sound read-only because they do not necessarily alter the source file. They still move file content out of Google Drive. Export can also transform a Google Workspace document into another MIME type before the bytes enter agent context, local storage, or a second service.

Permission to see a file name is not permission to read its body. Permission to read a document in Drive is not permission to upload it to another provider, attach it to a prompt, create a public link, or retain a copy after the task ends.

Record the source file, requested format, destination, audience, retention, and deletion plan before any content transfer.

Permission reads expose people and sharing policy

The reviewed permissions-list schema requires a file ID and can return up to 100 permissions per page. It also accepts shared-drive support, a published-view option, and a useDomainAdminAccess flag.

Google Drive permissions identify users, groups, domains, or anyone-with-the-link access, along with roles such as owner, organizer, writer, commenter, or reader. That information can be sensitive even when the file body is not read.

Do not include permissions in a generic metadata-reader role. Require one verified file ID, a reason to inspect sharing, a small page size, and domain-admin access disabled unless a named administrator approved that exact job.

Delete is different from trash

The reviewed permanent-delete wrapper warns that deleting a folder can remove nested files and subfolders. Google's current documentation makes the ownership boundary more precise: when a folder is deleted, descendants owned by the requesting user are also deleted. The same documentation distinguishes recoverable trash from permanent deletion: trashed items can generally be restored within 30 days, while deletion removes them permanently and can revoke access for everyone who received the file.

Keep trash, restore, empty-trash, file delete, folder delete, and shared-drive delete as separate permissions. A reversible cleanup suggestion should never silently become permanent deletion.

What the Google Drive Surface Can Reach

File and folder discovery

Read-oriented Actions can find files and folders, inspect metadata, list children, retrieve custom properties and labels, list revisions, inspect parents, and enumerate shared drives. Queries can filter by name, full text, MIME type, owner, writer, timestamps, stars, trash state, or parent folder.

These are useful reader operations, but a query such as fullText contains reads a broader index than a name or metadata lookup. Searching a domain corpus is also materially different from searching one user's root folder.

Content transfer and transformation

The catalog includes downloads, Workspace-document export, file upload, resumable upload, URL-based upload, text-to-file creation, copies, and shortcuts. These can move data across systems, create duplicates, change formats, or establish new durable objects.

Set a maximum byte size, approved MIME types, destination folder, duplicate-prevention rule, and retention policy before transfer. Do not infer those decisions from the fact that a file is visible to the connected user.

Sharing, comments, replies, and permissions

Other Actions can list, create, patch, update, or delete permissions; create and update comments or replies; inspect access proposals and approvals; and include published-view permissions. These operations can change who can see a file and can notify real people.

Keep content review, collaboration, and access administration in separate roles. An agent that summarizes a document should not be able to share it, invite another person, resolve a comment, or change a role.

Moves, metadata changes, trash, and deletion

Write-oriented Actions can move files, add or remove parents, edit file content, update metadata and custom properties, change revision metadata, trash or untrash items, empty trash, and permanently delete files, folders, or shared drives.

These consequences have different recovery paths. A move can break a workflow or inherited access. A metadata edit can affect search and automation. Emptying trash or deleting a folder can be irreversible.

Watches and change feeds

Watch Actions can establish notifications for a file or change feed. A watch may not modify a file, but it creates an ongoing subscription and a destination for future metadata. Record the channel, expiration, receiver, secret-handling model, and cleanup step. Stop-watch is a separate lifecycle responsibility.

Use a Google Drive Permission Ladder

The ladder separates connection, discovery, content access, collaboration, and destructive administration. Each step should have its own allowlist and input ceilings.

A Safe First Test in Aident Loadout

Begin with the installed public CLI and current connection state:

aident account auth status
aident vault vault --action status \
  --integrationIds '["googledrive_tools"]'

If Google Drive is not connected, stop after discovery, schema inspection, and preflight. Do not paste OAuth tokens or service-account credentials into a prompt.

Search by the narrow job:

aident capabilities search \
  --query "Google Drive list five root items metadata only" \
  --types '["action"]' \
  --scope '{"integrationId":"googledrive_tools"}' \
  --targetEnv staging

Copy the exact public name of the returned file-search Action, then inspect it:

GOOGLE_DRIVE_FILE_SEARCH_ACTION="<PASTE_RETURNED_ACTION_NAME>"

aident capabilities get \
  --name "$GOOGLE_DRIVE_FILE_SEARCH_ACTION"

Preflight one explicitly bounded request:

aident capabilities preflight \
  --name "$GOOGLE_DRIVE_FILE_SEARCH_ACTION" \
  --input '{
    "folder_id":"root",
    "q":"trashed = false",
    "fields":"files(id,name,mimeType),nextPageToken",
    "corpora":"user",
    "pageSize":5,
    "orderBy":"modifiedTime desc",
    "includeItemsFromAllDrives":false,
    "supportsAllDrives":false
  }'

That exact input passed schema validation and returned a free Aident quote during this review. It was not executed. The request intentionally overrides the broader shared-drive defaults observed in the current schema.

Success is narrow: return no more than five IDs, names, and MIME types from the connected user's root folder, make no Drive change, retrieve no file body, and expose no permissions, comments, owners, web links, or shared-drive data. A person selects one file and states the next question before any second read.

Record Eight Things Before a Drive Write

Before an agent changes Google Drive, record:

1. Identity: the Google account, Workspace domain, OAuth connection, and effective scopes;

2. Action: the exact current Action, API method, or MCP tool;

3. Target: the verified file, folder, shared drive, comment, permission, or watch channel ID;

4. Corpus: My Drive, one shared drive, the domain, or another explicit collection;

5. Input: the exact content, metadata fields, role, destination, query, or file bytes;

6. Audience: who can access the result before and after the operation;

7. Consequence and recovery: what will be created, moved, replaced, shared, trashed, or permanently deleted, and how it can be reversed; and

8. Read-back: the smallest independent Drive read that proves only the approved consequence occurred.

For uploads, copies, comments, and permissions, add an idempotency or duplicate-prevention plan. For moves, preserve the original parents. For destructive operations, verify ownership, descendants, shared-drive role, retention, and a tested recovery path before approval.

Common Google Drive Agent Permission Mistakes

Treating all accessible drives as one corpus

The connected user may see personal files, team folders, and multiple shared drives. Defaulting to all drives can mix owners, policies, and sensitivity levels. Name one corpus and one folder whenever possible.

Requesting every field for convenience

The Drive API supports partial responses for a reason. File IDs, names, and MIME types are often enough for selection. Permissions, owners, links, labels, and capabilities should be added only when the next decision requires them.

Letting metadata discovery become content ingestion

Finding a file does not authorize download, export, OCR, summarization, or transfer to another model or service. Ask for a human-selected file and an approved content purpose before crossing that boundary.

Confusing trash with permanent deletion

Trash can be recoverable; permanent delete and empty-trash operations are not equivalent. Keep those Actions out of ordinary cleanup roles and require a descendant-aware read-back before any folder deletion.

Trusting content inside a file

Documents, comments, filenames, and links are untrusted data. They can contain malicious instructions, false approval claims, or requests to widen tool access. Never let retrieved Drive content redefine the task or authorize another Action.

Using a free quote as a safety verdict

The five-item metadata preflight returned $0.00 in Aident cost. Cost approval and consequence approval are separate. A free metadata read can still expose sensitive names, and a free write can still alter access or permanently remove data.

Repeat the Review When the Contract Changes

Re-run discovery when Google changes Drive API methods, OAuth scope sensitivity, shared-drive roles, query behavior, page limits, trash retention, or deletion semantics; when Aident changes the Google Drive Action version, schemas, risk metadata, pricing, or connection flow; or when the agent's role expands.

This September 21 review is a contract audit, not a security certification or live-account test. It did not execute a Drive Action, inspect private files, read file bodies, enumerate real permissions, test shared-drive administration, compare direct-provider latency, or verify every observed Action against a live Workspace account. Its useful conclusion is narrower: the visible surface mixes metadata, content transfer, collaboration, persistent watches, recoverable changes, and irreversible deletion, so least privilege requires the exact identity, corpus, folder, fields, limit, destination, audience, and consequence.

Inspect One Drive Reader Before Enabling Writes

Follow https://aident.ai/SETUP.md

Set up Aident Loadout and inspect one Google Drive metadata reader

Use the risk-versus-spend approval workflow to keep free but consequential Actions gated. For neighboring Google integrations, continue with Connect Google Calendar to Codex With Aident Loadout and Connect Gmail to Codex With Aident Loadout.

Sources

• Choose Google Drive API scopes, reviewed September 21, 2026.

• Google Drive files.list, reviewed September 21, 2026.

• Google Drive permissions.list, reviewed September 21, 2026.

• Share files, folders, and drives, reviewed September 21, 2026.

• Manage shared drives, reviewed September 21, 2026.

• Trash or delete files and folders, reviewed September 21, 2026.

• Google Drive for Aident Loadout, reviewed September 21, 2026.

• Aident Loadout setup, reviewed September 21, 2026.

• Live Aident Loadout staging capability catalog, four exact Google Drive schemas, and one exact-free preflight, inspected September 21, 2026.

Refresh this review when Google changes Drive OAuth scopes, file search behavior, shared-drive roles, permissions, transfer methods, trash retention, or deletion semantics, or when Aident changes the Google Drive Action set, schemas, operation metadata, connection flow, pricing, or approval behavior.