Unapproved access?

Unapproved access?

Gemini could search my firm’s files and use what it found to draft our emails. Our governance had not approved that.

Google’s Workspace Intelligence lets Gemini search your Gmail, Drive and Docs, Calendar and Chat when it answers a question. When I set up our Workspace in June, all four were switched on by default. I saw no notice at sign-up. On November 14, 2026, Google Tasks joins, also on by default.

In September, during our governance review, I turned off “Smart features in other Google products” in Gmail. My own test then showed Gemini still reading across mail, calendar and chat. I logged it as an open question. The answer turned out to be a separate set of settings in the admin console, and they were all on. Even someone who does this for a living can miss it.

I found them because our governance process caught Google’s notice about the Tasks change. Our vendor monitoring flagged it, I opened the console, and I switched all five sources off.

Google gave notice of the Tasks change and an admin control, and it says: “Your data is never used to train generative AI models or for advertising purposes.” Gemini also reaches only what the person using it can already open. That cuts both ways. Every firm lives with some security by obscurity: people have access to files they never knew existed. AI raises the risk. A tool that searches everything a user can open can surface and compile client data, contracts or material non-public information that someone could always open but never found. And the same tool drafts your emails and documents. Once that information is in a draft, often the only thing between it and the wrong recipient is the person who clicks send. So the main risk here is not training. It is what an AI tool can draw on, where its output can go, and whether anyone checked who can open what.

The fix is ordinary governance:

1. Write down what each AI tool can access, and check each setting against it.
2. Name someone to read vendor notices.
3. Check who can open what before you switch AI search on.
4. Treat an AI-written draft like any outgoing document: someone reads it before it leaves the firm.
5. Test the tool, because what it can reach is not always what you assumed.
6. Keep the notice, the screenshots and your decision as evidence.

If you run Google Workspace: Admin console, then Generative AI, then Gemini in Workspace, then Workspace Intelligence. Decide each source on purpose, on or off, before November 14.

Written for compliance and risk readers in regulated financial firms. Informational, not legal advice; Mike Bidun is not a lawyer.