Zero trust for Google Workspace

An access level is a named set of conditions — corporate IP range, encrypted disk, screen lock enabled, minimum OS version, approved geography. Levels are defined once and then attached to applications for particular org units, which is why the modelling work matters more than the console work.

Model the levels around how people actually work rather than around an ideal. A field engineering team on cellular connections cannot satisfy a corporate-IP condition, and writing one anyway produces a helpdesk queue rather than security. Two or three well-chosen levels usually cover an organisation; a dozen produces conflicts nobody can reason about.

A policy that requires a managed device is meaningless until devices are enrolled and reporting state. Endpoint management enrolment therefore runs first, and the policy phase does not begin until enrolment coverage is above ninety-five per cent with a named owner chasing the remainder.

Personal devices are the awkward case. Basic mobile management covers most needs without agent installation, and where staff decline enrolment the honest answer is a reduced access level rather than an exception that quietly bypasses the model.

Phase one runs every policy in monitor mode and reports what would have been blocked. Phase two enforces for a volunteer pilot group of ten to twenty users drawn from different teams. Phase three enforces by org unit on a published schedule with a support window staffed for the first two days of each wave.

Before any of that, a break-glass super-admin account is created, excluded from all context policies, secured with two hardware keys held separately, and tested. It is the difference between a bad afternoon and an unrecoverable tenant, and it takes fifteen minutes.

Context-Aware Access evaluates the conditions of a request. It does not know whether the person holding a compliant, enrolled, correctly located laptop is the employee or someone who has taken their session. Session length limits and reauthentication on sensitive applications narrow that window but do not close it.

Nor does it help with data already exported. A user who satisfies every condition can still download a shared drive to a managed laptop and take it with them, which is a data-loss-prevention and offboarding problem rather than an access one.