Whenever an invoice PDF arrives from a business partner, the person in charge manually moves it into a designated Drive folder. Once moved, they type "Sent to accounting" into a Google Chat space. It takes less than a minute per invoice, but at the end of the month, they repeat this exact same motion dozens of times.
There is a reason why this kind of "final manual step" has been left out of automation. Until now, what you could do in Workspace Studio centered on read-side operations—such as summarizing, assessing, and notifying—while being designed so that a human handles write-side operations like moving file locations or replying to contacts.
That boundary is shifting. And when a boundary shifts, what causes problems later if not determined in advance are the administrator-side settings.
"Read-Only Automation" and "Action-Taking Automation" Are Completely Different Things
Four steps are being added: moving Drive files and folders, copying them, replying to Google Chat, and replying to emails. Google Chat replies support Markdown, allowing formatted text including list notation and code blocks to be posted to specific spaces and threads.
When listed out, they might look like minor additions, but their operational implications change substantially.
| Existing steps | New steps being added | What happens when a mistake occurs |
|---|---|---|
| Reading and assessing content | Moving or copying Drive files | Files are created that cannot be found when searched for |
| Notifying the person in charge | Replying to a Google Chat thread | Erroneous text remains visible in spaces that include business partners |
| Applying a label | Replying to an email | Delivered to the recipient as a sent email |
With read-only automation, even if the output was incorrect, a human could simply discard it. With automation involving write actions, mistakes leave the organization as things that "actually occurred." Moving a file in Drive can be undone, but sending an email reply cannot.
Drawing the line here shares the exact same structure as how requirements change between letting AI read data versus write data. If you apply the distinction between "reading/drafting" and "updating" organized in permission design when directly connecting AI to CRM directly to flow automation, you will not go wrong.
Two Controls Handed to Administrators
In conjunction with this change, Google provides two controls in the Admin console.
First is disabling on a per-step basis. Rather than turning off all four new steps at once, you can configure granular settings such as "allow Drive move and copy, but disable email replies." You can close off only high-risk steps to match your organization's actual circumstances.
Second is requiring end-user approval for actions where data might be shared outside the organization. This setting prevents the flow from completing autonomously, requiring a human approval checkpoint before execution. The primary targets are posts to Google Chat spaces with external members and replies to external email addresses.
These two align closely with the philosophy behind the administrative controls for external steps (Webhooks) that have been in Workspace Studio for some time. It is a consistent design principle: "treat actions going outside the organization separately."
The Decision Deadline Is in Early September
The decision timeline is embedded in the staged rollout schedule. According to current reports, full rollout of administrator settings begins September 1, and the rollout of the features themselves starts September 8. Only the steps related to Gmail are shifted back by one week, with administrator settings rolling out September 8 and the features on September 14.
What matters here is the sequence. Because admin settings arrive first, if you leave defaults untouched, users can start building flows the day the features reach them. Put another way, the few days between when settings roll out and when features arrive serve as your grace period to set policies.
The Gmail steps were likely delayed for the same reason: an extra buffer period has been allocated for email replies, the step where mistakes are least reversible.
These features are available on Business and Enterprise editions, provided that administrators have enabled Gemini. Do not assume your edition is eligible based on guesswork; verify it directly in the Admin console.
Where Teams Actually Get Stuck: "Whose Permissions Does It Run Under?"
The confusion that occurs on the ground after opening up settings almost always takes the same form: Does it run under the permissions of the flow creator, or under the permissions of the executor every time the flow runs?
Moving files in Drive turns into immediate incidents here. If a file is moved to a folder visible to the creator but invisible to the executor, the person who moved it can no longer track it down afterwards. Most inquiries claiming a file has disappeared simply involve a file moved outside their permissions.
Therefore, before enabling write-type steps, you must check the flow's execution context in advance. The issue of "under which identity it runs" discussed in access management and auditing in Workspace Studio takes on practical operational significance here.
Another factor requiring caution is the blast radius when combined with loop processing. An error you would notice for a single item becomes an issue where, once loop processing expands to hundreds of items, everything has already been executed by the time you notice. For flows that place move or copy actions inside loops, it is safest to define an upper limit on target items beforehand.
What to Do This Week
Open the Workspace Studio settings screen in the Admin console, and document whether each of the four new steps is currently enabled or disabled as-is. You can decide whether to change them later; the initial objective is simply recording the current state.
Next, pick one Google Chat space that includes external participants, and ask the person in charge: "Would it cause problems if automated posts were made to this space?" If the answer is yes, you immediately have your justification for introducing the approval requirement.
How far to open the scope of automation and how to design approval flows for external actions depend on your business processes and current permission architecture. GleamHub offers free IT and Google Workspace consultations to help you review and organize your current setup. Please contact us via our inquiry form.
Sources
- Automate Drive, Gmail, and Google Chat actions with new steps in Workspace Studio — Google Workspace Updates
- More granular admin controls for Workspace Studio steps and starters — Google Workspace Updates
- Get started: Workspace Studio set up guide for admins — Google Workspace Admin Help
- Google Workspace Studio Is Now Available: Access, Cost, and Flows — itechguides
