# removePermission

Remove a permission from a file (by permissionId or emailAddress)

Agent View of the PolicyLayer registry record for `removePermission`. HTML page: https://policylayer.com/tools/ark7-google-drive-mcp/removepermission

## Facts

- Tool: `removePermission`
- Server: Google Drive (`@ark7/google-drive-mcp`) — https://policylayer.com/tools/ark7-google-drive-mcp.md
- Install: `npx -y @ark7/google-drive-mcp`
- Homepage: https://www.npmjs.com/package/@ark7/google-drive-mcp
- Risk category: Destructive (Critical risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 4 (1 required)
- Recommended policy verdict: Hidden

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `fileId` | string | yes | Google Drive file ID |
| `account` | string | no | Alias of the Google account to target. Optional — defaults to the session/global default account, or the sole authenticated account. Run manage_accounts list to |
| `emailAddress` | string | no | User email (alternative to permissionId) |
| `permissionId` | string | no | Permission ID |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "removePermission",
    "arguments": {
      "fileId": "<fileId>"
    }
  }
}
```

## Why removePermission is rated Critical

Removing a permission is a destructive, irreversible action that revokes a user's or group's access to a file. This cannot be undone automatically; re-granting access requires knowing the original permission details. Misuse by an AI agent could lock out legitimate users or collaborators from important files, making the blast radius high.

From the tool's own definition: "'Remove a permission from a file (by permissionId or emailAddress)' — explicitly removes access control entries irreversibly"

## Use case

AI agents call removePermission to permanently remove resources in Google Drive, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

## Recommended policy (PolicyLayer)

Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Google Drive:

```json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "removePermission"
  ]
}
```

## Other tools on Google Drive (130)

- `deleteCalendarEvent` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deletecalendarevent.md
- `deleteComment` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deletecomment.md
- `deleteDimensionGroup` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deletedimensiongroup.md
- `deleteGoogleSlide` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deletegoogleslide.md
- `deleteItem` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deleteitem.md
- `deleteRange` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deleterange.md
- `deleteSheet` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deletesheet.md
- `deleteSlideElement` — Destructive — https://policylayer.com/tools/ark7-google-drive-mcp/deleteslideelement.md
- `authGetStatus` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/authgetstatus.md
- `authListScopes` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/authlistscopes.md
- `authTestFileAccess` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/authtestfileaccess.md
- `describeGoogleDocRange` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/describegoogledocrange.md
- `downloadFile` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/downloadfile.md
- `exportSlideThumbnail` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/exportslidethumbnail.md
- `getCalendarEvent` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getcalendarevent.md
- `getCalendarEvents` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getcalendarevents.md
- `getComment` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getcomment.md
- `getDocumentInfo` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getdocumentinfo.md
- `getGoogleDocContent` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgoogledoccontent.md
- `getGoogleDocContentPaginated` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgoogledoccontentpaginated.md
- `getGoogleDocImage` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgoogledocimage.md
- `getGoogleDocStyleSummary` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgoogledocstylesummary.md
- `getGoogleSheetCells` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgooglesheetcells.md
- `getGoogleSheetContent` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgooglesheetcontent.md
- `getGoogleSlidesContent` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgoogleslidescontent.md
- `getGoogleSlidesSpeakerNotes` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getgoogleslidesspeakernotes.md
- `getRevisions` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getrevisions.md
- `getSlideElementInfo` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getslideelementinfo.md
- `getSpreadsheetInfo` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/getspreadsheetinfo.md
- `listCalendars` — Read — https://policylayer.com/tools/ark7-google-drive-mcp/listcalendars.md
- …and 100 more: https://policylayer.com/tools/ark7-google-drive-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=ark7-google-drive-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/ark7-google-drive-mcp