Google Drive

GOOGLE WORKSPACE · FILES & DOCS

Browse, read, and write files inside the user’s own Drive.

Connect Google Drive with Fabriq Developer

Your user consents at Google Drive. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.

provider “drive”

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="drive")   # consent at Google Drive
return redirect(url)

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting Google Drive in practice

The scope that lets an agent look through a user’s existing files is restricted, and the non-sensitive alternative, drive.file, only ever sees files the app itself created or the user explicitly picked, so "find my signed contract" either triggers a security assessment or cannot see the file at all. Quota is charged in units with a wide spread, so a listing pass costs twenty times a single read.

Scopes that draw scrutiny

https://www.googleapis.com/auth/drive Restricted. View and manage all Drive files, so it carries the App Defense Alliance assessment.
https://www.googleapis.com/auth/drive.readonly Restricted. Views and downloads every file the user can reach.
https://www.googleapis.com/auth/drive.metadata.readonly Restricted even though it reads no file content, which surprises teams who picked it to stay out of review.
https://www.googleapis.com/auth/drive.scripts Restricted. Modifies Apps Script behaviour, so it can change what runs in the tenant.
https://www.googleapis.com/auth/drive.apps.readonly Sensitive. Lists the apps already authorized on the user’s Drive.

Rate limits

325,000 quota units per minute per user per project.
1,000,000 quota units per minute per project.
Per-method cost: download 200, files.list 100, files.update 50, files.get 5, files.generateIds 5.
1 TB per day per project of egress.
400,000,000 quota units per 24 hours is the billing threshold.

Who has to approve

Drive is named in Google’s Workspace API controls documentation as one of the products for which an admin can restrict a predefined list of high-risk OAuth scopes, on top of setting the app itself to Trusted, Limited, specific Google data, or Blocked.

Worth knowing

drive.file is the only non-sensitive route to user content and is limited to files the app created or the user opened with it, so it cannot back open-ended search.
Both 403 with "User rate limit exceeded" and 429 with "Rate limit exceeded" are throttling responses here, so code that treats 403 as a permission failure will silently misread overload as a missing grant.
The restricted-scope security assessment is annual, not one-off, so the cost recurs every year the integration ships.

Checked against Drive API-specific authorization (2026-09-29), Drive usage limits (2026-09-29), Restricted scope verification (2026-09-29), Workspace app access control (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

google_drive_copy_fileWRITE

Create a copy of a file in Google Drive. IMPORTANT: You must first call google_drive_list_files to get the file_id.

drive

google_drive_create_fileWRITE

Create a new file in Google Drive. Returns the created file ID and URL.

drive

google_drive_create_folderWRITE

Create a new folder in Google Drive. Returns the created folder's ID and URL.

drive

google_drive_delete_fileWRITE

Permanently delete a file from Google Drive. WARNING: This cannot be undone. IMPORTANT: You must first call google_drive_list_files to get the file_id.

drive

google_drive_download_fileREAD

Download a file's content from Google Drive. For Google Docs/Sheets/Slides, exports in the specified format. IMPORTANT: You must first call google_drive_list_files to get the file_id.

drive.readonly

google_drive_get_fileREAD

Get metadata for a specific file in Google Drive. IMPORTANT: You must first call google_drive_list_files or google_drive_search_files to get the file_id. Do NOT use placeholder values.

drive.readonly

google_drive_list_filesREAD

List files in Google Drive. Returns a list of files with their ID, name, and MIME type.

drive.readonly

google_drive_move_fileWRITE

Move a file to a different folder in Google Drive. IMPORTANT: You must first call google_drive_list_files to get both file_id and folder_id.

drive

google_drive_search_filesREAD

Search for files in Google Drive using a query string. Returns matching files with their IDs, names, and MIME types.

drive.readonly

google_drive_share_fileWRITE

Share a file with a user. You MUST provide the recipient's email address. Example: share_file(file_id='abc123', email='user@example.com', role='reader')

drive

google_drive_update_fileWRITE

Update a file's metadata in Google Drive (name, description, etc.). IMPORTANT: You must first call google_drive_list_files to get the file_id.

drive

google_drive_upload_fileWRITE

Upload a file to Google Drive. Returns the uploaded file ID and URL.

drive