New employee Google Drive access: what to grant on day one and what to hold back
It is Monday morning, and the new hire pings you on Slack: "I can't open any of the team files." You are between meetings, so you share the whole root folder to make the problem go away. That takes ten seconds, but new employee Google Drive access granted that way tends to stay in place for months. This guide walks through a five-step routine: define the role, see what a teammate can open, pick the right level, share subfolders, and write down what you granted.
In this guide
- Why new employee Google Drive access ends up too wide or too thin
- Step 1: Define the role and the file groups it needs
- Step 2: See what teammates in the same role can open
- Step 3: Pick the role level: Viewer, Commenter or Editor
- Step 4: Share subfolders or a group, not the root folder
- Step 5: Record what you granted and set a review date
- Use Wistorix to review access by email
- Common mistakes when granting a new hire access
- Frequently asked questions
Why new employee Google Drive access ends up too wide or too thin
There are two ways to get this wrong, and both come from rushing. The first is too little access. The new hire asks for files one at a time, you get pulled out of your work again and again, and they spend the first week waiting.
The second is too much access. To stop the pings, you share the root folder and move on. A few months later that person can still open salary sheets, client contracts or finance reports that their job never needed.
The root cause is usually the same: nobody remembers what a teammate in the same role can open. Without a model to compare against, you grant access from memory or copy your own, and a manager's access is almost always wider than a typical role needs.
It helps to sort folders into three groups before you share anything:
- Shared docs: processes, templates and internal guides that everyone on the team uses.
- Project folders: only the projects the new hire is actually joining.
- Sensitive folders: HR, finance and contracts. Do not grant these by default.
Step 1: Define the role and the file groups it needs
Before you click Share, write down what the person will do in week one. That list drives most of the decisions about new employee Google Drive access that follow. Aim for five to ten folders tied to real work, not a vague "everything the team has."
Ask the direct manager
Ask one plain question: which folders will this role open every week, and which will it need by the end of the first month? Grant the first set now and leave the second until there is a reason. Adding access later is always easier than taking it back.
Put it in an onboarding note
Write the answer in a short onboarding note instead of keeping it in someone's head. A shared doc or a ticket in your HR tool works fine. Mark every sensitive folder as "do not grant" unless the manager confirms the need in writing.
Step 2: See what teammates in the same role can open
A teammate who does the same job is your best reference. They already work with the files the newcomer will use, so their access shows you what "enough" new employee Google Drive access looks like.
The manual way in Drive
Open each usual folder in Google Drive, click Share, and read the list of people with access. Note which folders include your model teammate and at what level. For a team with a handful of folders, this is perfectly workable.
The catch is that it is slow and easy to miss things. A subfolder can be shared separately with one person, and you will not see that if you only open the parent folder.
Pick the right model
Choose a teammate with the same title, not the longest-tenured person on the team. Long-serving employees often keep access from old projects and past roles. If you have two model teammates, use only the folders they both have.
While you read the lists, note anything that looks like a leftover rather than a real need. Those items should not be copied to the new hire.
Step 3: Pick the role level: Viewer, Commenter or Editor
For new employee Google Drive access, Drive offers three common levels when you share a folder. According to Google's guide to sharing files and folders, an Editor can "open, edit, delete, or move any files within the folder, as well as add new files." The same page adds that Editors can also change permissions and share items by default.
| Role | What the person can do | Use it when |
|---|---|---|
| Viewer | View the folder and open the files inside | Shared docs, processes and reports that are read-only |
| Commenter | View files and add comments and suggestions | Drafts that need feedback but not direct edits |
| Editor | Open, edit, delete, move and add files | A project folder the person works in every day |
Start with Viewer or Commenter, then move to Editor only where the person must change files. For a folder holding contracts or payroll, skip Editor unless the job truly requires it. One accidental delete there costs far more than a few minutes waiting for an upgrade.
Step 4: Share subfolders or a group, not the root folder
This step decides whether new employee Google Drive access ends up too wide. Share the specific subfolder that matches the work, and the access applies to everything inside it. Google states it plainly: "When you share a folder, all files and subfolders inside it inherit those same sharing permissions."
That inheritance is exactly why sharing the root folder is risky. One click at the top opens the whole tree below it, including corners you did not think about. It also works the other way: you cannot give someone less access to a file than they have to its parent folder.
Use a Google group if you already have one
If your organization keeps a Google group for each team, add the new hire to that group and share the folders with the group. Next time, you add one person to the group instead of re-sharing every folder. If you have no groups and the team is small, sharing with named people still works.
Avoid sharing single files one by one
Sharing individual files sounds tidy, but it is hard to track. Months later, nobody remembers which file was opened for whom. If one file really needs separate sharing, write it in the log from the next step.
Check inherited access
After you share, open the Share dialog on a file deep in the folder and check who is listed. Confirm the new hire appears only where you intended. If a parent folder gives them more than you planned, fix it at the parent level.
Step 5: Record what you granted and set a review date
New employee Google Drive access that you grant but never record soon becomes access nobody owns. A simple spreadsheet with a few columns is enough:
| Column | What to write | Example |
|---|---|---|
| Person | The new hire's work email | New accountant |
| Folder | The subfolder you shared | Monthly reports |
| Role | Viewer, Commenter or Editor | Viewer |
| Date and approver | When you granted it and who said yes | Start date, approved by the finance lead |
Then put a reminder on your calendar to review the log a few weeks into the role, on whatever schedule suits your team. At that review, drop what the person does not use and upgrade what they clearly need. Repeat the check whenever they change teams.
The same log makes offboarding faster later. When the person leaves, you already know which folders to check. For that stage, see our guide to Google Drive handover.
Use Wistorix to review access by email
When a team has many folders, opening each Share dialog takes a long time. This is where Wistorix can help: it is a Chrome extension that reviews and optimizes Google Drive. It reads only admin information about files, such as name, size, owner and sharing permissions, and does not read file content.
After a scan, you review by email to see which files one person currently has access to. Run it on a teammate and you have a concrete list to check against when you grant new employee Google Drive access. You still grant the new access with Google's Share button.
Wistorix can also revoke access or change roles (Viewer, Commenter, Editor) in bulk. It only runs after you review the list and choose, and nothing is deleted automatically. Read more on the sharing risk scan page, or see how in-house teams use it.
To check a teammate's access on your own Drive, choose Review access now at wistorix.com. The scan is free.
Common mistakes when granting a new hire access
These are the slips that most often spoil new employee Google Drive access, with what they cost and how to avoid them:
| Mistake | What goes wrong | How to avoid it |
|---|---|---|
| Sharing the root folder | The new hire can see sensitive files | Share the subfolder that matches the job |
| Editor everywhere "for now" | Easy to delete or move files by accident | Start with Viewer, upgrade on request |
| Copying a former employee's access | Old project access carries over | Use a current teammate as the model |
| Opening General access to "Anyone with the link" | Anyone who gets the link can open the file | Share with specific work emails |
| Forgetting temporary access | Onboarding access stays for months | Set a review date in the log |
The last two cause the quietest damage. A link set to "Anyone with the link" can be forwarded to people outside the company. Temporary access that never expires turns into permanent access by default.
When someone eventually leaves, the same habits apply in reverse. Our guide to checking and removing employee access covers that side, and the broader Google Drive offboarding page ties the whole lifecycle together.
Frequently asked questions
What Google Drive access should a new employee get on day one?
Good new employee Google Drive access on day one is small: give Viewer or Commenter on the shared docs and the project folders the role uses weekly. Add Editor only where the person must change files. Leave HR, finance and contract folders out unless the manager confirms the need.
Should I share the whole root folder with a new hire?
No. According to Google, all files and subfolders inherit the sharing permissions of the folder you share. Share the specific subfolders that match the job instead.
How can I see what a teammate in the same role can open?
The manual way is to open each folder, click Share and read the people list. With many folders, you can review by email in Wistorix to see which files one person currently has access to.
Does Wistorix read the content of my files?
No. Wistorix reads only admin information such as file name, size, owner and sharing permissions. It does not read or store file content.
sharing publicly?