Glean Permissions Depend on Connector Mode, Sync State, and Sharing

Glean can answer a search from an indexed permission snapshot or a live source check, with hybrid access combining both. That choice determines when a revoked Google Drive or Slack permission stops affecting results. "Respects source permissions" is therefore the start of the review, rather than its conclusion.

TL;DR

• Indexed access mirrors source permissions during crawls; live access asks the source during the request.
• Google Drive discoverability has documented cases for domain-shared and link-required files.
• Source access, Glean admin roles, agent sharing, and outbound model policy are separate permissions and need separate revocation tests.

Indexed and live authorization

Glean's connector overview says connectors retrieve content and permissions from source systems. Indexed access relies on a permission snapshot mirrored during crawls and incremental updates. Live access queries the source while handling the user request. Hybrid access combines those approaches.

That distinction creates a measurable revocation window. Remove a user from a source group, then time how long the old result remains visible through search and an assistant answer. Repeat the check through an agent tool call. A screenshot taken before the crawl proves little. The useful artifact is a timestamped test with the source change, Glean result, connector mode, and final convergence time.

The test should begin with a result the removed account can actually open. Record the source permission change before repeating the same query from that account. Keep the query text fixed so a wording change does not obscure the authorization result. If the connector uses indexed access, continue checking until the result disappears. If it uses a live check, capture what the user sees immediately after removal.

The answer also needs to distinguish discovery from content access. Record whether the document appears in results and whether its contents reach the response. Those observations show where the old permission remains effective. Run the same sequence again after restoring access, because a revocation test alone does not confirm that the intended user can regain the document.

Google Drive has connector-specific behavior

The Google Drive permissions documentation describes domain-shared documents and the "Can find in search results" setting. It also documents "Must have link to access" behavior. Prior access and collaboration sharing can affect discoverability. Pinned links can affect it too.

A buyer should avoid turning that page into a universal statement about every connector. Glean says permission behavior varies by connector and configuration. Feature behavior can also differ. Open a browser with two test accounts, one entitled and one recently removed, and run the same query. That physical two-window test catches assumptions hidden by an administrator's own broad access.

Use documents with known sharing states for that comparison. One account should retain the expected source permission while the removed account provides the negative case. Keep both browser windows visible and label the accounts before collecting evidence. That prevents an administrator session or a cached login from being mistaken for the restricted user.

Domain-shared and link-required documents deserve their own rows in the test record. A result for one sharing state does not establish the behavior of another. The review should preserve the source setting beside each observed Glean result so the connector behavior can be reproduced later.

Administrative and agent permissions

Glean's shared-responsibility model assigns customers responsibility for SSO policy, terminated-user removal, administrator RBAC, connector credentials, and permission review. The agent-sharing guide treats sharing and editing separately. It also defines publishing authority.

These are different control planes. A source owner decides who can read a document. A Glean administrator configures the connector and platform roles. An agent owner chooses who can use or edit an agent. I would reject a single spreadsheet cell marked "permissions supported" because it erases the exact boundary an incident investigation needs.

A useful access review names the owner of each control plane and records the revocation action available there. Removing source access tests the document boundary. Removing a Glean role tests administrative authority. Changing agent sharing tests who can invoke or modify the agent. Each action should produce its own evidence rather than inheriting a pass result from another layer.

Published agents need a test account that lacks source access as well as a user who retains it. Run the same agent action from both accounts and preserve the observed result. This shows whether the agent-sharing decision and the underlying document permission produce the expected combination.

The routed AI boundary

Native Glean search, crawling, and source ACL synchronization run inside Glean's hosted product. An external HTTP AI gateway cannot repair a stale source permission or intercept the hosted interface by assumption. Our Glean DLP analysis covers that product boundary.

A customer-controlled application may call an LLM after retrieving Glean content. If that outbound model request is deliberately routed through an enforcement layer, the gateway can inspect the prompt, evaluate caller identity, apply policy, and record the decision. The AI policy enforcement guide describes that separate path.

The routing requirement should be verified from the application path, rather than inferred from the presence of a gateway account. Capture the destination used by the customer-controlled application and the corresponding policy decision. If the request bypasses the enforcement layer, the gateway has no decision to apply or record.

DeepInspect

DeepInspect governs authenticated HTTP calls between customer applications or agents and LLMs. It can stop retrieved content from crossing an approved model boundary when that call is routed through the proxy. It does not administer Glean connectors or source ACLs.

Book a technical deep dive at deepinspect.ai.