Shared Drive Permissions: What Each Google Drive Role Can Actually Do

Every Shared Drive in Google Workspace hands out access through five named roles, and the names mislead often enough that most teams pick the wrong one. Content Manager sounds like the top of the ladder. Contributor sounds junior. Neither is quite right, and the gap shows up months later — when a file cannot be moved, a folder cannot be cleared, or the only person who could add a new member left the company in March. Shared Drive permissions take about ten minutes per Drive to get right, and they are the cheapest access decision an ops team makes.

The five Shared Drive permissions, in plain terms

Every member of a Shared Drive holds exactly one of these roles. Everything below the top two is narrower than people assume:

• Manager — full control: add and remove members, change roles, move files out of the Drive, and delete the Drive itself

• Content Manager — add, edit, move and delete files inside the Drive, but cannot change who has access

• Contributor — add and edit files, but cannot move them out of the Drive or delete them

• Commenter — read and comment, with no edits

• Viewer — read only

One rule covers most cases: grant the narrowest role that lets someone finish their work, and treat Manager as an ownership decision rather than a seniority one.

Manager and Content Manager are not the same job

The functional gap between the two is membership and destruction. A Content Manager does all the day-to-day work — create, edit, reorganise, remove files — but cannot add a person, remove a person, change anyone’s role, or delete the Drive. Almost everyone who asks for “full access” to a Shared Drive means Content Manager.

Managers are a different thing. A Manager can hand access to anyone, including people outside your domain if your admin settings allow it. That makes the Manager list the shortest and most consequential list in the Drive.

Every Shared Drive needs at least two Managers

A Drive with a single Manager is one resignation away from being stuck. Once that account is suspended, nobody inside the Drive can add members, change roles or adjust its sharing settings, and a super admin has to step in from the admin console. It is a small, avoidable escalation, and it turns up in almost every offboarding.

Name two Managers per Drive, ideally not on the same team, and re-check the pair whenever either of them changes role.

External members change what Shared Drive permissions mean

If your organisation allows external members, a Shared Drive role is a standing grant to someone outside your domain — renewed automatically every day nobody looks at it. A contractor with Contributor can keep adding files long after the engagement ends; a Commenter keeps reading everything in the Drive indefinitely. Shared Drive roles carry no expiry date, and unlike “anyone with the link” sharing, they are not visible from the file itself. You have to open the Drive to see them.

How to review Shared Drive permissions without an admin console

Reviewing Shared Drive permissions does not take Workspace admin rights. Open a Drive you belong to, open Manage members, and read the list against three questions — the same three that a manual permissions audit starts with:

• Is every Manager someone who genuinely owns this content, and are there at least two of them?

• Is anyone on the list external, and does the project they were added for still exist?

• Is anyone sitting at a higher role than their actual work requires?

Write the answers down with a date against them. A review nobody recorded is indistinguishable from a review nobody ran.

Set the Drive’s sharing rules once, then review on a cadence

Each Shared Drive also carries restrictions that sit above the roles: whether non-members can be given access to individual files, whether people outside the organisation can be added at all, and whether Viewers and Commenters can download, print or copy. Set these when the Drive is created rather than after something leaks.

Then put membership on a cadence — quarterly, plus every role change and every departure. Access does not drift because anyone is careless; it drifts because the work moves on and the permissions do not, which is one of the clearest signs a Drive needs a cleanup.

---

If you are not certain what your Shared Drive permissions currently add up to, start with what is already there. NeatDrive runs a free audit of your Google Drive — external shares, “anyone with the link” files, orphaned folders and connected third-party apps — so you can see who can reach what before your next access review. Run your free audit at app.neatdrive.net.