# manage_permissions Manages who can access a file. action=list shows the grants (id, type, role, emailAddress/domain, expirationTime, pendingOwner). action=share grants access: type=user/group (needs email_address), domain (needs domain), or anyone (link sharing; allow_file_discovery=true also makes it searchable); role=reader, commenter, writer, fileOrganizer/organizer (shared drives only) or owner. Sharing with a user emails them by default — send_notification_email=false suppresses it (not allowed for ownership transfers); email_message adds a note. action=update changes an existing grant's role (needs permission_id from list); action=remove revokes it. Ownership transfer: role=owner with transfer_ownership=true — between personal accounts this only INVITES the new owner (pendingOwner until they accept). Changes are live immediately; removing your own access to someone else's file is irreversible from your side. role=owner/organizer grants full control including permanent deletion — prefer writer or less. Agent View of the PolicyLayer registry record for `manage_permissions`. HTML page: https://policylayer.com/tools/a1-x-tech-mcp-google-drive/manage-permissions ## Facts - Tool: `manage_permissions` - Server: Mcp Google Drive (`@a1-x-tech/mcp-google-drive`) — https://policylayer.com/tools/a1-x-tech-mcp-google-drive.md - Install: `npx -y @a1-x-tech/mcp-google-drive` - Homepage: https://github.com/A1-x-Tech/mcp-google-drive - Risk category: Destructive (Critical risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 12 (2 required) - Recommended policy verdict: Hidden ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `role` | string | no | share/update: the access level. fileOrganizer/organizer exist only on shared drives; owner transfers ownership. | | `type` | string | no | share only: who the grant is for. user/group need email_address; domain needs domain; anyone = link sharing. | | `action` | string | yes | What to do with the file's permissions. | | `domain` | string | no | share with type=domain: the Workspace domain, e.g. example.com. | | `file_id` | string | yes | The file id — the long id from the Drive URL (drive.google.com/file/d/ or docs.google.com/.../d//edit) or from search_files/get_file output. Fol | | `page_token` | string | no | list: nextPageToken from the previous page. | | `email_address` | string | no | share with type=user/group: the grantee's email address. | | `email_message` | string | no | share: a custom note for the notification email. | | `permission_id` | string | no | update/remove: the permission id from action=list. | | `expiration_time` | string | no | update: RFC3339 expiry for the grant, e.g. 2026-12-31T00:00:00Z (not available for owners). | | `transfer_ownership` | boolean | no | share with role=owner: confirm the ownership transfer (required by the API for role=owner). | | `allow_file_discovery` | boolean | no | share with type=domain/anyone: whether the file can be FOUND by search (default false = link only). | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "manage_permissions", "arguments": { "action": "", "file_id": "" } } } ``` ## Why manage_permissions is rated Critical An AI agent that decides to call manage_permissions doesn't hesitate, doesn't double-check, and doesn't stop at one. Whatever it removes from Mcp Google Drive is gone. There is no undo for destructive operations. Risk signals: High parameter count (13 properties) ## Use case AI agents call manage_permissions to permanently remove resources in Mcp Google Drive, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo. ## Recommended policy (PolicyLayer) Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mcp Google Drive: ```json { "version": "1", "default": "deny", "hide": [ "manage_permissions" ] } ``` ## Other tools on Mcp Google Drive (14) - `delete_file_forever` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/delete-file-forever.md - `manage_comments` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/manage-comments.md - `raw_request` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/raw-request.md - `trash_file` — Destructive — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/trash-file.md - `download_file` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/download-file.md - `get_file` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/get-file.md - `list_shared_drives` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/list-shared-drives.md - `search_files` — Read — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/search-files.md - `copy_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/copy-file.md - `create_folder` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/create-folder.md - `export_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/export-file.md - `move_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/move-file.md - `update_file_metadata` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/update-file-metadata.md - `upload_file` — Write — https://policylayer.com/tools/a1-x-tech-mcp-google-drive/upload-file.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=a1-x-tech-mcp-google-drive · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/a1-x-tech-mcp-google-drive