Hello Reader,

For over two decades, our job as IT admins has focused on managing human users—provisioning their accounts, assigning their licenses, and locking down what they can and cannot do.

We are now crossing into an entirely new era of domain administration: managing AI agents that act autonomously across Google Workspace.

Google recently rolled out a new Agent Control section in the Admin Console. Here is a plain-English breakdown of what these policies do and how to use them.

🍁 Register for the Fall Admin Bootcamp!

The Google Admin Bootcamp is a comprehensive overview of the Google Admin console. You'll learn about the latest updates including managing AI agents for your district. These LIVE virtual sessions are perfect for new and experience IT administrators.

Registration is limited to 30 participants.

Fall Cohort:

• Dates: October 6, 8, 13, 15, and 20
• Location: LIVE via Google Meet (sessions are recorded)
• Time: 1-2:30 pm EST
• Cost: $299/person

Google Workspace Studio

​Google Workspace Studio is where staff can design, build, and deploy custom AI agents and automated "flows." Workspace Studio is similar to tools like Zapier and IFTTT.

Users can construct workflows that trigger specific tasks across their Google Workspace apps. For example, a high school counselor or administrative assistant could set up a flow that monitors incoming parent inquiries from a form, summarize student data from a Sheet, or automate a sequence of follow-up steps using Gmail.

While that sounds great for productivity, it can also lead to misuse of sensitive data or out of control automations.

👉 Note: Workspace Studio is ON for all users. You may want to review your current access settings for students.

Agent Guardrails

Admin Path: Apps > Google Workspace > Settings for Workspace Studio

If you aren’t ready to deal with agents, you can disable Workspace Studio entirely, or give select users access. You can also configure specific services and actions that can be used to create agents:

• Read vs. write / trigger permissions: You don't have to give agents full reign over an app.
• Require approval for flows that share data with external users
• A Real-World Example: You might allow an AI flow to analyze an email thread and generate a draft in Gmail, but strictly restrict the agent from actually pressing "Send."

Agent management is incredibly new. It will take some time to understand which actions are safe and which ones could be risky.

Upcoming Events for Google Admins

Want to host a Google Admin workshop in your area? Get in touch!

• ​Google Admin Bootcamp (Online) - October 6-20, 2026
• ​MassCUE Conference (Foxborough, MA) - Oct. 14, 2026
• ​Google Admin Bootcamp (Atlanta, GA) - Oct. 27, 2026
• ​Chromebook Academy (Online) - Nov. 5 - 19, 2026 (join wait list)
• ​HECC Conference (Indianapolis, IN) - Nov. 11-13, 2026
• ​Brainstorm Poconos (Pocono Manor, PA) - Nov. 15-17, 2026

Managing Existing Agents

If you look in your Admin Console navigation, you’ll spot a new section dedicated specifically to Agent Control. This area is split into two sections:

Settings (The "Master Switch")

Admin Path: Agents > Settings

This page acts as the global gatekeeper for your entire domain.

• By default, the master switch allowing flows to access Google Workspace data is set to ON.
• Disabling this switch completely blocks all flows and agents from touching any domain data across Gmail, Drive, Docs, and other services, regardless of the settings for Google Workspace Studio.
• Note: turning off data access will break existing flows. If this is your desired configuration, you may wish to disable access to Workspace Studio to prevent user confusion.
• If you keep it enabled, the granular service controls you configured in AI Studio (like restricting email sending or file modifications) will govern what those agents can do.

Agent Management

Admin Path: Agents > Agent Access Management

The Agent Access Management console provides direct visibility into all flows created by users across your organization:

• Flow Details: See the name of the flow, the name and email of the user who created it, and the exact timestamp it was deployed.
• Service Footprint: View precisely which Google services (Drive, Gmail, Contacts, Calendar) the flow is actively touching.
• Actionable Oversight: If an agent looks poorly constructed, touches sensitive records, or violates student privacy policies, admins can instantly pause or permanently disable the flow with a single click.

IT Admins are Now "Agent Managers"

In the future, staff members won't just create Docs and Sheets; they will build autonomous assistants that read spreadsheets, draft correspondence, sort through Drive folders, and trigger scheduled tasks.

If those agents aren't audited, governed, and bounded by strict security policies, you will quickly face data-leak landmines and unintended email storms. Agent management isn't a speculative future responsibility—it's arriving in the console right now.

Recommended Action Items

1. Audit Existing Flows: Open Agent Access Management to see if any ambitious staff members have already built active flows. Identify what data sources they are connecting to.
2. Check the Master Switch: Review your settings for Google Workspace Studio. Make sure that access is disabled for students and consider who should have access while you evaluate district policy for agent creation.
3. Restrict Destructive Actions: Under the AI Studio controls, review the permissions for Gmail and Drive. Restrict the ability for agents to execute automated outbound sends or permanent file updates without human intervention.
4. Staff Training: Introduce your staff to the concept of AI agents. Ask them too excercise care when creating agents. Audit user-created flows monthly to see how agents are being used in your organization.

During my fall Admin bootcamp I'll be spending some extra time reviewing and discussing AI agents through the console. Registration is open...I hope you can join me!