Google Workspace Studio enhances enterprise security features. Additions include Agent Identity (automation via flows runs with a unique ID that has minimal permissions), strengthened audit logs, and enhanced administrative controls (such as OAuth scope revocation), making it even more secure to use.

Google Workspace Updates: New enterprise security controls for Workspace Studio enable expanded collaboration use cases

Source: https://workspaceupdates.googleblog.com/2026/08/new-enterprise-security-controls-for-Workspace-Studio-enable-expanded-collaboration-use-cases.html August 17, 2026

• Other
• Security and Compliance
• Workspace Studio

Workspace Studio enables users to boost their productivity with custom, no-code agentic automation. Today, we are adding a new set of enterprise security controls to enable additional collaboration use cases. These granular identity, data protection, observability, and governance controls provide admins with more confidence to safely enable and adopt agentic capabilities in their organization.

Built-in, enterprise security controls in Workspace Studio include:

• Agent identities
• Agent access management
• Agent auditing and observability
• Admin settings / human-in-the-loop (HiTL)
• Runtime protections

Collaboration use cases

When Studio initially launched, it was only able to assist users in their tasks, such as drafting an email, not executing tasks autonomously, such as sending an email. Now, Studio supports cross-user collaboration through the introduction of several new steps with built-in guardrails.

Collaboration actions in Studio Flows**Agent identities:**Automation with flows in Studio will continue to run with the user’s identity, but in a least-privileged way. This means that the flow will have the minimal set of privileges required to run, and not the full set of privileges the owner has. When the flow executes, it will do so with a unique, auditable identifier.**Note:**the least-privilege agent identity will apply to newly created flows only. Existing flows will be supported in the future.

**(Beta) Identity attribution:**Admins, through a new setting, will be able to decide whether the actions taken by a flow show the owner’s identity, or are attributed to the flow itself, with the owner information made visible. This will default to “on”; meaning the actions by the flow will be attributed to the flow.**Note:**the agent identity attribution setting will apply to newly created flows only. Existing flows will be supported in the future.

Flow represented as the owner’s identity“ Flow attributed as the flow’s name with owner’s information**Auditing and observability:**Actions in Studio across configuration and execution events are recorded in Studio audit events. Additionally, audit events for actions, such as edits made to a file in Drive or emails sent in Gmail, will include flow context, such as a unique flow identifier and the owner’s information.**Note:**agent context in audit logs will apply to newly created flows only. Existing flows will be supported in the future.

**Agent access management:**In the admin console, an Agent access management dashboard gives admins the ability to suspend all flows or targeted OAuth scopes for individual flows, such as revoking Drive access. Additionally, the security investigation tool enables admins to transition directly from an audit event to the agent access management page, facilitating swift remediation during incident investigations.**Note:**after the rollout, newly created flows will be shown in Agent access management. Existing flows will be supported in the future.

Agent access management dashboard**Admin settings & human-in-the-loop:**Additional admin settings will support disabling specific step types for flows, disabling Gemini data access, enforcing end-user confirmation for steps that share data externally, and disabling webhook integrations.

Flow asking for human approval before it sends an email externally**Runtime protections:**Additional data loss prevention (DLP) features for Gemini data access and Studio flows are available for added protection. Gemini DLP restricts Gemini’s ability to access Drive data based on content conditions and labels, with support for additional services coming soon. Agent DLP will support restrictions on Studio flow execution, including blocking or enforcing end-user review, based on conditions of the sourced data, utilized data, and data visibility of the output.

Studio DLP### Rollout pace

Admin console settings

• Rapid and Scheduled Release domains:Rollout starting today (up to 3 days for visibility)

End-user visible features

• Rapid Release domains:Rollout starting August 20, 2026 (up to 3 days for feature visibility).
• Scheduled Release domains:Gradual roll out (up to 15 days for feature visibility) starting September 1, 2026

(Beta) Identity attribution

• Rapid Release domains:Rollout starting today, over a gradual period of 7 days
• Scheduled Release domains:Gradual rollout (up to 15 days for feature visibility) starting August 24, 2026

Getting started

• Admins:
• **End users:**Once available, end users can access the steps by visitinghttps://studio.workspace.google.com/

Availability

Available for Google Workspace*:

• Business Starter, Standard, and Plus
• Enterprise Starter, Standard, and Plus
• Education Fundamentals, Standard, and Plus

Also available to*:

• Google AI Pro for Education
• Google AI Ultra for Business

* Gemini DLP, and DLP for Studio are available only for Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus