💡 New script: drive-sharing-expiry (automated time-based Drive sharing permission revocation)

[github-actions[bot]]

Summary

A GAS script that lets users define sharing lifetime rules (e.g., "revoke external sharing after 30 days," "expire viewer access to folder X after 7 days") and automatically revokes permissions when they expire. Sends a courtesy notification email before revocation and maintains a Sheets-based audit log of all sharing changes.

Market Signal

Enterprise tools like BetterCloud ($3–10/user/mo) and Spin.AI offer automated sharing lifecycle management, but exclusively for Workspace admin accounts. Personal Google account users have zero tools for sharing expiry — files shared for a one-time meeting stay shared indefinitely, creating an invisible but growing security surface. Google's own February 2026 update deprecated enforceExpansiveAccess for Drive permissions, signaling a platform-level push toward tighter sharing controls. The broader trend: 2026 has seen "security hygiene for personal accounts" emerge as a category — individuals are adopting practices previously limited to enterprise IT.

User Signal

Idea discussion #505 (drive-sharing-audit) proposes a visibility report — "who can see what." This script is the complementary action layer: once you know what's shared, automatically clean it up on a schedule. The project's target audience (individuals and small teams) has no admin console access for sharing policies — this fills a genuine governance gap. Zero bug reports against the Drive API integration in gmail-to-drive-by-labels suggest the project's Drive API usage patterns are stable and well-tested.

Technical Opportunity

Drive API v3 permissions.list and permissions.delete are well-documented and available in GAS via DriveApp and the Advanced Drive Service. Sharing metadata includes creation timestamps, so no separate tracking database is needed for time-based rules — a simple age calculation (shared_date + TTL < now) suffices. The config pattern matches existing scripts: rules defined in config.gs (folder ID, TTL days, notification preferences), logic in src/index.js with dependency injection. Deploy page Step 4 can provide Drive Picker for folder selection plus a lifetime dropdown (7 / 14 / 30 / 90 days).

Assessment

Dimension	Score	Rationale
Feasibility	high	Drive API permissions management is well-documented; age-based filtering is simple computation; follows established project patterns
Impact	med	Addresses a real security gap for personal users; complements drive-sharing-audit (#505); ongoing automated protection
Urgency	med	Google's deprecation of enforceExpansiveAccess signals tighter sharing controls are coming; early positioning in the personal-security space

Adversarial Review

Strongest objection: Automatically revoking sharing without explicit user confirmation could disrupt active collaborations and cause data access loss for collaborators who still need the files.

Rebuttal: Three safety mechanisms prevent accidental disruption: (1) configurable notification email sent N days before revocation (default: 3 days) with a "keep sharing" action link; (2) rules are opt-in per folder/file, never applied globally — users explicitly choose which folders have expiry policies; (3) a Sheets-based audit log records every revocation with the file name, revoked user, and timestamp for easy re-sharing. The script never deletes files — it only revokes sharing permissions, which owners can instantly restore from the audit log. Safe defaults (30-day expiry, 3-day warning) err on the side of caution.

Suggested Next Step

Prototype Drive API permissions.list scan for files shared externally in a test folder; implement age-based filter (shared_date + TTL < now); design the config schema for per-folder rules with TTL, notification preferences, and exclusion patterns (e.g., "never expire sharing with specific email addresses").