Tired of missing out on the coolest Google updates and new features? Join thousands of other teachers who rely on my monthly newsletter to stay ahead of the curve. Get the top 10 updates, teaching inspiration, and time-saving links delivered straight to your inbox.
Share
📨 Google Admin Weekly: Managing AI Agents
Published about 2 months ago • 4 min read • Google Admin Weekly
Hello Reader,
For over two decades, our job as IT admins has focused on managing human users—provisioning their accounts, assigning their licenses, and locking down what they can and cannot do.
We are now crossing into an entirely new era of domain administration: managing AI agents that act autonomously across Google Workspace.
Google recently rolled out a new Agent Control section in the Admin Console. Here is a plain-English breakdown of what these policies do and how to use them.
🍁 Register for the Fall Admin Bootcamp!
The Google Admin Bootcamp is a comprehensive overview of the Google Admin console. You'll learn about the latest updates including managing AI agents for your district. These LIVE virtual sessions are perfect for new and experience IT administrators.
Registration is limited to 30 participants.
Fall Cohort:
Dates: October 6, 8, 13, 15, and 20
Location: LIVE via Google Meet (sessions are recorded)
Google Workspace Studio is where staff can design, build, and deploy custom AI agents and automated "flows." Workspace Studio is similar to tools like Zapier and IFTTT.
Users can construct workflows that trigger specific tasks across their Google Workspace apps. For example, a high school counselor or administrative assistant could set up a flow that monitors incoming parent inquiries from a form, summarize student data from a Sheet, or automate a sequence of follow-up steps using Gmail.
While that sounds great for productivity, it can also lead to misuse of sensitive data or out of control automations.
👉 Note: Workspace Studio is ON for all users. You may want to review your current access settings for students.
Some of the "Flow" that I have created with Workspace Studio
Agent Guardrails
Admin Path: Apps > Google Workspace > Settings for Workspace Studio
If you aren’t ready to deal with agents, you can disable Workspace Studio entirely, or give select users access. You can also configure specific services and actions that can be used to create agents:
Read vs. write / trigger permissions: You don't have to give agents full reign over an app.
Require approval for flows that share data with external users
A Real-World Example: You might allow an AI flow to analyze an email thread and generate a draft in Gmail, but strictly restrict the agent from actually pressing "Send."
Agent management is incredibly new. It will take some time to understand which actions are safe and which ones could be risky.
Upcoming Events for Google Admins
Want to host a Google Admin workshop in your area? Get in touch!
If you look in your Admin Console navigation, you’ll spot a new section dedicated specifically to Agent Control. This area is split into two sections:
Settings (The "Master Switch")
Admin Path: Agents > Settings
This page acts as the global gatekeeper for your entire domain.
By default, the master switch allowing flows to access Google Workspace data is set to ON.
Disabling this switch completely blocks all flows and agents from touching any domain data across Gmail, Drive, Docs, and other services, regardless of the settings for Google Workspace Studio.
Note: turning off data access will break existing flows. If this is your desired configuration, you may wish to disable access to Workspace Studio to prevent user confusion.
If you keep it enabled, the granular service controls you configured in AI Studio (like restricting email sending or file modifications) will govern what those agents can do.
Agent Management
Admin Path: Agents > Agent Access Management
The Agent Access Management console provides direct visibility into all flows created by users across your organization:
Flow Details: See the name of the flow, the name and email of the user who created it, and the exact timestamp it was deployed.
Service Footprint: View precisely which Google services (Drive, Gmail, Contacts, Calendar) the flow is actively touching.
Actionable Oversight: If an agent looks poorly constructed, touches sensitive records, or violates student privacy policies, admins can instantly pause or permanently disable the flow with a single click.
You can now view and audit user-created agents in the admin console
IT Admins are Now "Agent Managers"
In the future, staff members won't just create Docs and Sheets; they will build autonomous assistants that read spreadsheets, draft correspondence, sort through Drive folders, and trigger scheduled tasks.
If those agents aren't audited, governed, and bounded by strict security policies, you will quickly face data-leak landmines and unintended email storms. Agent management isn't a speculative future responsibility—it's arriving in the console right now.
Recommended Action Items
Audit Existing Flows: Open Agent Access Management to see if any ambitious staff members have already built active flows. Identify what data sources they are connecting to.
Check the Master Switch: Review your settings for Google Workspace Studio. Make sure that access is disabled for students and consider who should have access while you evaluate district policy for agent creation.
Restrict Destructive Actions: Under the AI Studio controls, review the permissions for Gmail and Drive. Restrict the ability for agents to execute automated outbound sends or permanent file updates without human intervention.
Staff Training: Introduce your staff to the concept of AI agents. Ask them too excercise care when creating agents. Audit user-created flows monthly to see how agents are being used in your organization.
During my fall Admin bootcamp I'll be spending some extra time reviewing and discussing AI agents through the console. Registration is open...I hope you can join me!
Regards,
John R. Sowash
Did someone forward this email to you? You can subscribe here!
John Sowash is a former teacher and an "accidental" Google Administrator. For more than a decade John has been helping schools use technology in meaningful ways. John lives in Michigan with his wife and five kids.
Tired of missing out on the coolest Google updates and new features? Join thousands of other teachers who rely on my monthly newsletter to stay ahead of the curve. Get the top 10 updates, teaching inspiration, and time-saving links delivered straight to your inbox.
✨ FREE LIVE Session: Earn a Gemini Badge with me TONIGHT at 7pm EST! ✨ Hi Reader! I've been speaking at several fall conferences the past few weeks. Its great to get out of the office and meet people "IRL"! I enjoyed attending MASS CUE in New England and the Great Lakes Unity conference in Grand Rapids, MI. During these events I had an opportunity to introduce teachers and administrators to the Google Educator Series, a really neat program from Google that allows you to earn official Gemini...
Hello Reader, I feel bad that I’ve spent a lot of time talking about negative and scary uses for AI, but not much time discussing the cool, positive ways that teachers can use tools like Gemini and Gemini Notebook in the classroom. I want to take a short break from heavy, technical topics to introduce you to a cool (and free) professional learning resource for teachers called the Google AI Educator Series. Introducing the Google AI Educator Series The Google AI Educator Series (GES) is a...
Hello Reader, Today I want to share five practical settings you can update to improve the classroom experience. These aren’t complicated, but they make a HUGE difference for teachers and students. These are just some of the things that I'll be covering during the Chromebook Academy for IT admins next month. If you're interested in manage Chromebooks more effectively, you're invited to join us! Oh, and if you happen to be at the MASS CUE conference this week, say hello! I'm doing a session on...