> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/agentic-gateway/mcp-server/google-drive.md). # Google Drive Install the Google Drive integration and its MCP server so agents behind the P0 AI Gateway can request access to folders and files in your Google shared drives. The **Google Drive** integration lets agents behind the P0 AI Gateway (see [P0 Runtime Access for AI](/readme/agentic-control-plane.md)) request access to a folder or file in one of your Google shared drives. Each grant goes to a new service account that P0 creates for that grant alone, and the gateway calls Drive as that account. When the grant ends, P0 removes the account's access and deletes it. Agents can request two roles on a folder or file: * `reader`: read the item. * `writer`: also create, edit, and comment. Access to a folder covers everything in it. {% hint style="info" %} The Google Drive integration is in beta. Functionality and configuration may change. {% endhint %} Setup has four parts, in this order: 1. Deploy the Drive connector in a Google Cloud project. 2. Register each shared drive, and add the connector as a manager of it. 3. Add the Google Drive MCP server to your gateway. 4. Write the policies that decide which agents get which access. ## Prerequisites * A registered [Gateway](/agentic-access/agentic-gateway/gateway.md) component, with the gateway deployed in your environment. * The [GCP Service Account Creator](/agentic-access/credential-sources/gcp-service-account-creator.md) installed on a Google Cloud project. The Drive connector runs in that same project, and P0 creates the service accounts it grants to there. * The Google Drive API (`drive.googleapis.com`), the IAM API (`iam.googleapis.com`), and the Cloud Run Admin API (`run.googleapis.com`) turned on in that project. The Terraform P0 generates doesn't turn them on. * Permission to apply Terraform in the project. * A user with the **Manager** role on each shared drive you want to register. ## Deploy the Drive connector 1. Navigate to **Integrations** on [p0.app](https://p0.app), select **Google Drive**, and choose the **Drive connector** component. 2. Click **Add Project**, select the Google Cloud project, then click **Next**. The dropdown lists the projects where the GCP Service Account Creator is installed. 3. P0 generates a Terraform configuration. Copy it into your Terraform project, `apply` it, then click **Next**. The configuration creates: * A service account, `p0-iam-manager-drive-@.iam.gserviceaccount.com`. * A Cloud Run service, `p0-connector-google-drive-ai`, that runs P0's connector as that service account. * An invoker binding that lets P0's Google Cloud service account call the connector. The connector accepts calls from that service account only. The connector's service account gets no role on the project. Its only access is the shared drives you add it to in the next section. 4. When you click **Next**, P0 checks that the connector is deployed. A new Cloud Run service can take a minute to start. If the check fails, wait a minute and click **Next** again. 5. Review the summary and click **Finish**. To grant in shared drives from another project, repeat these steps for that project. Each shared drive you register names the project that manages it. ## Register a shared drive 1. Open the shared drive in your browser and copy its URL from the address bar. It looks like `https://drive.google.com/drive/folders/`.

Copy the URL of the shared drive itself, not of a folder inside it. P0 accepts a folder's URL, but every grant in that drive then fails.

2. In P0, on the **Google Drive** integration, choose the **Shared drive** component and click **Add Shared drive**. 3. Fill in the shared drive details, then click **Next**: * **Drive identifier**: the name agents, policies, and the CLI use for this drive in P0, such as `finance-reports`. Use lowercase letters, digits, and hyphens, starting and ending with a letter or digit, up to 63 characters. * **Google shared drive URL**: the URL you copied. * **Service account project**: the project whose Drive connector manages this drive. 4. P0 shows the connector's service account and a link to the drive. In Google Drive, open the shared drive, choose **Manage members**, and add that service account with the **Manager** role. Lower roles can't share items in the drive, so grants fail without it. Then click **Next**. 5. Review the summary and click **Finish**. 6. The shared drive now appears with the state **Installed**. Repeat for each shared drive you want agents to reach. Agents can only request access in drives you register here. ## Add the Google Drive MCP server You can add the Google Drive MCP server once at least one shared drive is installed. 1. Follow the shared steps in [MCP server](/agentic-access/agentic-gateway/mcp-server.md#add-an-mcp-server) to name the server and choose its gateway. On the configuration screen, set the following fields, then click **Finish**: * **Credential source**: choose **Service account impersonation**. * **Definition**: choose **P0**, then select **Google Drive** as the predefined server identifier. 2. The server now appears with the state **Installed**. P0 pushes the server definition to the gateway on its next sync, and the Google Drive MCP server becomes available to agents through the gateway URL. ## How agents request access An agent requests access by naming the drive by its P0 identifier, the folder or file by its Drive ID, and a role. The Drive ID is the last part of the item's URL, as in `https://drive.google.com/drive/folders/`. The equivalent CLI request is: ```bash p0 request google-drive-ai resource --reason "" ``` Once a request is approved, access usually works within 15 to 45 seconds, and can take up to two minutes. Agents see every Drive tool whether or not their access covers an item. Drive answers `404` for an item outside the agent's access. See [Requesting access](/agentic-access/using-the-gateway/requesting-access.md) for how agents submit and use requests. ## Write policies for Google Drive Match Google Drive requests in an agentic access policy (see [Agentic access policies](/policy-studio/policy-studio/agentic-access-policies.md)) with `service: google-drive-ai` and `accessType: resource`. Three filters narrow them: * `drive`: the shared drive. Key on `id`, the identifier you gave the drive in P0. * `resource`: the folder or file, keyed on its Drive `id`. * `role`: `reader` or `writer`, keyed on `id`. For example, auto-approve read-only access for one agent, but only in the `finance-reports` drive: ```yaml - requestor: type: agentic actor: type: agent-client clientId: reporting-agent subject: type: any resource: type: integration service: google-drive-ai accessType: resource filters: drive: effect: keep key: id pattern: ^finance-reports$ role: effect: keep key: id pattern: ^reader$ approval: - type: persistent ``` ## Next steps * Define the [Agentic access policies](/policy-studio/policy-studio/agentic-access-policies.md) that determine which agents and users may request Google Drive access.