# Share Sweep

> Audit files shared outside an organisation. Paste a sharing export - a CSV or tab-separated report with file,
> folder, owner, shared-with and role columns; a GAM-style file list with permissions.N.emailAddress, role, type and
> domain columns; a Drive API JSON file list with permissions; or plain "file | who | role" lines - and your own
> domains. The page classes every grant (inside, an outside person, a personal mailbox, a whole outside domain, anyone
> with the link, public on the web), marks file names that look sensitive, ranks the outside grants and draws a flow
> map from your folders to the outside audiences. A metered run plans each outside grant - revoke, make view-only,
> keep, or ask the owner - and the page checks every action against its own rule. Nothing is changed from the page.
> Built on the SkillSafe skill @googleworkspace/recipe-audit-external-sharing.

https://share-sweep.skillsafe.ai/

## What is free
- Reading exports: the header row is found by a file column plus a shared-with, a link-sharing or permissions.N columns; JSON is read as a Drive files list with permissions; without a header, lines of file, who and role split by | or tabs. Owner grants are set aside; the same file and grantee count once, at the strongest role.
- Classes: inside when the grantee's domain is one of yours (or under it); Gmail, Outlook, iCloud, Yahoo, Proton and the like are personal mailboxes; a type of domain or a bare domain is a whole outside domain; anyone and allowFileDiscovery mark links and public files. With no domain given, the most common owner domain is taken as yours.
- Severity: high for public on the web, or a link, an editor or a commenter on a sensitive-looking name (contract, salary, budget, board, customer, donor and similar words in the name or folder); medium for other links, outside editors and commenters, personal mailboxes, and outside viewers of sensitive-looking names; low for other outside viewers.
- The flow map (PNG, SVG) and a CSV of every grant with its class, role, severity and plan.
- GAM commands for the plan's revoke and view-only steps, when the export carries a file id column (gam user you print filelist fields id,name,owners,permissions). Nothing is run from the page.
- Open a saved audit and paste a newer export: the page lists the outside grants gone, new and with a changed role since the saved one.
- Cells a spreadsheet would read as a formula are prefixed with ' in the CSV. Exports past 20,000 lines are read up to that line and say how many lines were left out.
- Share Sweep is an independent tool, not affiliated with Google.
- Three samples (GAM, Drive JSON, CSV) replay their saved plans at no cost.

## The metered task
One task, `sharing`, on gpt-terra, metered per run. Input string fields: `task`, `goal` (who the files are meant for), `domains`, `totals`, `grants` (one line per outside grant, `g1.` ... up to 25: the file, a sensitive-looking mark, the folder, the owner, who it reaches and the role) and `others` (grants past the list, counted by audience). The reply is one JSON object: `verdict` (`exposed` or `contained`), `plan` (each `grant`, `action` - `revoke`, `keep`, `ask_owner` or `viewer` - `why` and `question`) and `note`.

The page checks each action against its own rule (revoke what is public or a link on a sensitive-looking name; keep what the goal names by address, domain or name; ask the owner about personal mailboxes and links; make other outside editors view-only), refuses lowering a view-only grant or a link, checks the verdict against the grants as they are, every number against the export, and warns on a gendered pronoun.

## Links
- API tutorial: https://share-sweep.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@googleworkspace/recipe-audit-external-sharing