Three Action Items for Admins This Week
You don't need to rewrite your entire board policy by Friday, but you should take 15 minutes to tighten your technical guardrails in the Admin Console.
1. Review Existing Agents
Google Workspace Studio allows users to build automated flows and custom skills without code. This service is enabled by default. Take a moment to view agents that have been created by your users:
- Where to go: Agents > Agent Access Management
- Action: This page will display agents that have been created by your users. You can view, audit, and pause agents from the admin console.
- Best Practice: users should receive training on building agents before they are given access to Workspace Studio.
Tip: If you aren't prepared to manage agents, you can limit access to Workspace Studio to a small pilot group (like your tech department or instructional coaches) before rolling it out district-wide.
2. Establish Human-in-the-Loop Boundaries
Educate your team on one simple rule: Never automate high-stakes actions without a human check. Any automated workflow that touches Personally Identifiable Information (PII), student disciplinary notes, or external communications to parents must keep confirmation safeguards enabled.
- Where to go: Apps > Google Workspace > Settings for Workspace Studio > Approvals
- Action: If Workspace Studio is ON for users, consider requiring human approval for sensitive steps and third-party connectors.
- Best Practice: establish a district definition for “sensitive data” and “sensitive action” so that you can implement your agent limitations appropriately.
3. Audit Third-Party API Connections
Gemini isn't the only way to create an agent. Your users can also create Agents with Claude, ChatGPT, Copilot, etc. These agents are more difficult to manage, because you can't "see" them. Agents require API access to take action. If your third-party app settings are wide open, staff can connect external autonomous agents without your knowledge.
- Where to go: Security > Access and data control > API controls
- Action: Click Manage App Access. Look closely at any apps requesting high-risk scopes (like full access to Gmail or Drive).
- Best Practice: Keep unconfigured third-party apps Blocked for students under 18, and set your Staff OU to "Allow apps that only request basic info" so full-access agents require explicit IT approval.
Tip: Workspace Audit, a premium tool for Google Workspace Admins, provides detailed data on the third party applications that are connected to your domain. Click here for a free 30 day trial.
Summary
Google’s updated TOS is very reasonable…they don’t want to be liable for the actions of your agents.
By keeping tight API controls, restricting agent creation to trusted staff, and ensuring humans stay in the loop for sensitive decisions, you can let your teachers embrace automation while keeping your district safe, compliant, and fully in control.
Learn more about this topic:
Got a question about how your domain's AI policies are configured? Click reply and let me know—I read every email!
John R. Sowash
Did someone forward this email to you? You can subscribe here!
John Sowash is a former teacher and an "accidental" Google Administrator. For more than a decade John has been helping schools use technology in meaningful ways. John lives in Michigan with his wife and five kids.
Google Admin Bootcamp | Chromebook Academy | Google Admin Audit
3606 Woodridge Dr. , Howell, Michigan 48843
Unsubscribe · Preferences