Because Gemini has been part of Google Workspace business plans since 2025, many businesses on Workspace have it already without anyone deciding to switch it on. It sits in the side panel in Gmail, Docs and Drive, answers questions across Drive and works in the Gemini app with access to a person's mail and files. In every one of those places it answers from what the signed-in person is allowed to open.
What it reads
Google is direct about the boundary. Its privacy hub says Gemini only retrieves content that the person asking already has access to, and that "if you don't have permission to see a file, the AI can't see it or use it either". When Google made Ask Gemini in Drive generally available in 2026, it said the feature respects existing access permissions, data loss prevention policies and information rights management.
That is the right design, and it moves the whole question onto one thing: what each person can open. The same is true of Copilot in Microsoft 365, and the reasoning is set out in full in what Copilot can already see.
Where Workspace sharing runs wide
Workspace makes sharing easy, which is most of its appeal, and the same ease leaves files open to more people than anyone meant.
- A file shared so that anyone at the company with the link can open it, set that way so one colleague could see it, stays open to everyone after that colleague has finished with it.
- A shared drive created for one team and given to a group that later grew is a common way for a whole business to gain access to a folder.
- People are added to Google Groups when they join a team and rarely removed when they move on, so their access to everything shared with those groups goes with them.
- When an account is removed, its files are usually transferred to a manager, and whatever sharing they had is carried across with them.
Four checks before more people get Gemini
You can run these with whoever administers your Workspace before anyone from outside is involved.
- Pick one person in the group you plan to enable next, and search Drive as they would for the words you would least like found: salary, payroll, performance review, settlement, password and the name of your largest client. Whatever they can open, Gemini can use on their behalf.
- Use the admin console's reports and the Drive audit log to see how many files are shared with the whole business or with anyone holding the link. The number tells you how much tidying comes first, and the oldest links are usually the ones nobody will miss.
- List the shared drives and check which groups are members of each, starting with any that include an all-company group.
- Walk through the last three people who left and check where their files went, who they are still shared with and which groups the people who inherited them belong to.
The controls Google gives you
Workspace has more controls here than most businesses use.
- Administrators control access to the Gemini app and can switch the service off.
- Administrators can choose which Workspace services, such as Gmail, Drive, Calendar and Chat, Gemini is allowed to search, according to the same privacy hub.
- Files restricted so people cannot download, print or copy them are not retrieved by Gemini on their behalf, which makes information rights management the closest thing to a per-file exclusion.
- On the editions that include it, data loss prevention rules for Gemini can restrict its access to Drive data, and Google has been adding classification labels that can be applied automatically.
Google also says Workspace does not use customer data to train its models without the customer's prior permission or instruction. While that covers the vendor's side, the sharing settings that decide what each of your people can open are still yours to manage.
Where this fits
Checking what the next group can reach, and tightening it before they are connected, is the permissions review in Guardrails, and it applies to Gemini exactly as it does to Copilot.
Whether Gemini is the right assistant for your business at all is covered in Claude, ChatGPT or Copilot, and for a Workspace business the starting point is that Gemini is already in the plan you pay for. The readiness snapshot is the first scoped piece of Track, and it shows where you stand before anyone widens access.