Configuring Enterprise Data Connectors and ACL Permission Mapping in Glean for Google Workspace and Slack

Enterprise workplace search and generative AI assistants are only as trustworthy as their underlying access control architecture. When IT administrators deploy Glean across Google Workspace and Slack, the fundamental requirement is absolute permission parity: search results and AI-generated answers must never expose confidential documents, restricted Slack channels, or private direct messages to unauthorized employees.

Glean achieves this without duplicating or redefining enterprise security policies. Instead, it mirrors source access control lists (ACLs) using a dual-engine architecture: ingestion-time permission-aware indexing for asynchronous document repositories like Google Drive, and federated, zero-copy real-time search (RTS) for high-velocity communication platforms like Slack. Unifying both environments is Glean’s automated Identity Graph, which resolves user aliases, cross-platform identifiers, and nested group memberships against the enterprise Identity Provider (IdP).

This guide walks IT and security administrators through configuring enterprise connectors, structuring identity and permission mapping, enforcing native visibility rules, and verifying ACL compliance across Google Workspace and Slack.

1. Architectural Foundations: The Dual-Engine Model and Identity Graph

To configure Glean effectively, administrators must understand how it processes access controls across different data types.

                           +-------------------------------------+
                           |      Corporate Identity Provider    |
                           |  (Okta / Entra ID / Google Identity)|
                           +------------------+------------------+
                                              |
                                              v
                           +-------------------------------------+
                           |         Glean Identity Graph        |
                           |  - User Identity Reconciliation     |
                           |  - Nested Group Membership Flattening|
                           |  - Cross-App UID Resolution (Slack) |
                           +------------------+------------------+
                                              |
                     +------------------------+------------------------+
                     |                                                 |
                     v                                                 v
  +-------------------------------------+   +-------------------------------------+
  |       Google Workspace Connector    |   |          Slack Connectors           |
  | (Google Drive / Gmail / Groups)     |   | (Slack Metadata + Slack RTS)        |
  +------------------+------------------+   +------------------+------------------+
                     |                                                 |
  - Service Account + Domain-Wide Delegation  - Centralized Marketplace OAuth App
  - Ingestion-Time Document & ACL Indexing     - Identity Crawls & Ranking Signals (Metadata)
  - Change APIs / Webhooks for DLS Sync       - Federated Zero-Copy API Querying (RTS)
  - Google Drive Link Visibility Enforcement  - Query-Time Native Slack Context & ACLs
                     |                                                 |
                     +------------------------+------------------------+
                                              |
                                              v
                           +-------------------------------------+
                           |     Query-Time Enforcement Filter   |
                           | User Principals ∩ Source Document   |
                           | ACLs + Real-Time Federated Streams  |
                           +------------------+------------------+
                                              |
                                              v
                           +-------------------------------------+
                           | Secure, ACL-Filtered Search Results |
                           |        and AI Synthesized Answers   |
                           +-------------------------------------+

Ingestion-Time ACL Indexing (Google Drive)

For document storage systems like Google Drive, Glean crawls content and its associated security principals (users, Google Groups, domain sharing policies). It indexes each document alongside an explicit ACL token set. When a user issues a query, Glean intercepts the request, constructs the user's active principal list (including all direct and inherited group memberships), and filters document candidates before ranking or generating AI responses.

Federated Real-Time Search (Slack RTS)

Slack conversations move at a speed that traditional batch crawling cannot safely or efficiently index. Glean solves this with its Slack Real Time Search (RTS) architecture—a federated, zero-copy connector. Glean does not persist Slack message bodies in its central index. Instead, when a user searches in Glean, the system issues a real-time call to Slack's search API on behalf of the querying user. Slack itself evaluates whether the user is a member of the public channel, private channel, or direct message thread. Unjoined private conversations are excluded at the API level before reaching the browser or generative model.

The Unified Identity Graph

Access controls fail if the search platform cannot correlate a user's Slack identifier (U12345678) with their Google Workspace email (user@company.com). Glean syncs accounts from your primary IdP (e.g., Okta, Microsoft Entra ID, or Google Workspace Identity) to build a canonical identity record. It links primary emails, secondary aliases, and connector-specific system UIDs, ensuring that permission evaluation remains consistent across disconnected SaaS silos.

2. Configuring the Google Workspace Connector and Permission Sync

Glean integrates with Google Workspace via a dedicated Google Cloud Platform (GCP) Service Account and Domain-Wide Delegation. This configuration enables Glean to impersonate designated directory administrators for crawl operations while preserving Google Drive’s native document-level security (DLS).

Step 1: Create the GCP Service Account

1. Open the Google Cloud Console under your organization's Google Cloud project.
2. Navigate to IAM & Admin → Service Accounts and click Create Service Account.
3. Name the service account (e.g., glean-enterprise-connector) and assign descriptive metadata.
4. Once created, click into the service account, navigate to the Keys tab, select Add Key → Create New Key, choose JSON, and save the downloaded key securely.
5. In the service account details, copy the numeric OAuth 2 Client ID (Unique ID). Do not use the service account's email address for domain delegation.

Step 2: Authorize Domain-Wide Delegation in Google Workspace

1. Sign in to the Google Workspace Admin Console (admin.google.com) as a Super Administrator.
2. Go to Security → Access and data control → API controls → Manage Domain Wide Delegation.
3. Click Add new and paste the numeric Client ID copied from GCP.
4. In the OAuth Scopes field, input the exact, comma-separated API scopes required for your integration:
   • https://www.googleapis.com/auth/drive.readonly (to crawl Google Drive documents, metadata, and ACLs)
   • https://www.googleapis.com/auth/admin.directory.user.readonly (to retrieve user profiles and account statuses)
   • https://www.googleapis.com/auth/admin.directory.group.readonly (to read Google Groups and nested memberships)
   • https://www.googleapis.com/auth/apps.groups.settings (to inspect group access policies)
   • Optional scopes if indexing other Google tools: https://www.googleapis.com/auth/gmail.readonly or Google Calendar scopes.
5. Click Authorize.

Step 3: Complete Setup in the Glean Admin Console

1. Log in to the Glean Admin Console and navigate to Platform → Connectors.
2. Select Google Drive (or Google Workspace) and initiate Setup.
   • Note for deployments created on or after August 14, 2026: Glean provides an automated, guided setup flow that configures Google Drive, Docs, Sheets, and Slides indexing with default read tools enabled. For prior deployments, upload the downloaded Service Account JSON key manually.
3. Configure the Directory Admin Email: Provide the email address of a Google Workspace administrator (or a custom admin role with read privileges on users, groups, and activity reports). Glean uses this identity to crawl Google Workspace Reports and Activity APIs for real-time change detection and ranking signals.
4. Set crawl scope and restrictions: Specify whether all organizational units (OUs) or specific Drive paths should be included.

Step 4: Critical Drive Visibility Rules to Understand

Google Drive allows broad sharing settings that can create unexpected security assumptions. Glean mirrors Google Drive’s native search rules precisely:

• Restricted Access Files: Files shared explicitly with individual users or specific Google Groups are strictly visible only to those principals.
• "Anyone with the link" and Domain-Shared Files: If a file is set to "General access: Anyone with the link" or shared company-wide, Glean does not automatically expose it in search results to every employee. The file is only discoverable if:
  1. The user has already opened or accessed the document in Google Drive.
  2. The Google Drive file permission setting "Searchable → Can find in search results" is explicitly toggled On.
  3. The link was shared in a Slack channel of which the user is an active member (optional setting configurable in Glean).
  4. The file has been pinned by administrators for a specific target audience.
• AI Assistant and Public Mode Impact: When deploying Glean Assistant in Slack using "Public Mode" or publishing an Agent with "Visible to everyone", Glean enforces strict hygiene: only documents where "Can find in search results" is enabled will ever be surfaced in channel-wide AI summaries. Documents marked "Must have link to access" are suppressed to prevent link-based information leaks.

3. Configuring the Slack Enterprise Connector and Real-Time Search (RTS)

Integrating Slack requires a coordinated two-part deployment: the Slack connector for identity and engagement signals, and the Slack Real Time Search (RTS) connector for live, permission-enforced message retrieval.

Step 1: Select Deployment Mode and Verify Prerequisites

• Plan Requirement: Slack Enterprise Grid is strongly recommended for multi-workspace organizations. Single Workspace mode is available for standalone Slack accounts.
• Administrator Role: The person configuring Slack Enterprise Grid in Glean must be a Slack Org Owner. For single workspaces, a Workspace Owner or Workspace Admin is required.
• Account Details: Gather your Slack Domain (the prefix before .slack.com or domain.enterprise.slack.com) and your Slack IDs:
  • Workspace ID (starts with T...)
  • Enterprise Grid ID (starts with E..., visible in your browser URL: app.slack.com/client/E12345678/...).

Step 2: Configure the Primary Slack Connector (Metadata & Signals)

1. In the Glean Admin Console, navigate to Platform → Connectors → Slack (or Slack Enterprise).
2. Click Setup and enter the gathered Slack Enterprise ID and Domain.
3. Authorize the centrally hosted Glean Slack Marketplace App. Required scopes include:
   • users:read, users:read.email (to build cross-system identity mapping)
   • channels:read, groups:read, im:read, mpim:read (to index channel structures and memberships)
   • usergroups:read (to map Slack user groups into the identity graph)
   • assistant:write, reactions:write, commands (to support Gleanbot and slash commands like /glean)
4. Confirm installation across all workspaces within the Slack Enterprise Grid organization.

Step 3: Configure the Slack Real Time Search (RTS) Connector

1. Once the base Slack connector is healthy, navigate back to Platform → Connectors and select Slack Real Time Search (RTS).
2. Click Setup and complete the OAuth authorization.
3. Verify API Endpoints: RTS utilizes Slack's specialized search endpoints:
   • assistant.search.context and search.messages: Live query execution against Slack's native index.
   • conversations.history and conversations.replies: Live extraction of thread context around matched messages.
   • conversations.members and users.info: Real-time validation of channel membership.
4. Zero-Copy Governance: Confirm that message persistence is disabled. RTS runs entirely in memory per user query. If a user is not in a private channel (e.g., #finance-leadership), Slack’s API omits the message from the RTS payload, guaranteeing zero leakage.

Step 4: Configure Channel Safeguards and Redlisting

1. Redlisting Sensitive Channels: If certain private or public channels must remain entirely invisible to search, contact Glean Support or configure connector exclusions using specific Slack Channel IDs (C...).
2. External Channel Isolation (Slack Connect): By default, Glean disables bot responses and suppresses search interactions in Slack Connect shared channels involving external third parties, eliminating data exfiltration risks.
3. Private Channel & DM Discovery: Private channels and direct messages require authorized user contexts. In an Enterprise Grid setup, the Org Owner can enable organization-wide access, but end users can also be prompted to authorize their personal Slack tokens for private message discovery where organizational policy requires explicit consent.

4. Permission Mapping, Group Resolution, and Synchronization Lifecycles

Understanding the timing and mechanics of permission updates ensures IT teams know when access revocations take effect across search results.

+-----------------------------------------------------------------------------------+
|                            Permission Synchronization Paths                       |
+-----------------------------------------------------------------------------------+
| Source System | Mechanism           | Sync Type     | Latency / Frequency         |
+---------------+---------------------+---------------+-----------------------------+
| Google Drive  | Full Ingestion Crawl| Batch         | Scheduled (Periodic baseline)|
| Google Drive  | Google Reports API  | Incremental   | Periodic (Minutes to hours) |
| Google Drive  | Push Webhooks       | Real-Time     | Near-instantaneous updates  |
| Google Groups | Admin Directory API | Identity Crawl| Periodic sync & flattening  |
| Slack Users   | Users / Channels API| Identity Crawl| Periodic metadata sync      |
| Slack Events  | Slack Events API    | Webhook       | Instant (e.g. member_joined)|
| Slack Messages| Slack RTS API       | Zero-Copy Fed.| Live at moment of query (0s)|
+-----------------------------------------------------------------------------------+

Recursive Group Expansion

Enterprises frequently nest Google Groups (e.g., Engineering contains Frontend, which contains UI-Team). When Glean executes an identity crawl, it performs recursive graph flattening. If a Google Doc is restricted to Engineering, every member of UI-Team receives a corresponding security token in Glean’s identity layer. When a user is removed from Frontend in Google Admin, the next incremental identity crawl updates their principal set, revoking search visibility for all upstream resources.

Handling Real-Time Revocations

• For Slack Messages: Permission revocations are immediate. Because Slack RTS calls Slack's API live at query time, removing a user from a private channel instantly blocks them from searching messages within that channel.
• For Google Drive: Revoking access directly on a file emits a change event via Google Drive’s Changes API and push webhooks. Glean processes these delta events to invalidate the cached ACL token in its search index. During normal operations, permission changes propagate within minutes.

5. Verification, Auditing, and Troubleshooting in the Admin Console

Never assume permissions work correctly without deterministic verification. Glean provides purpose-built tools for IT administrators to audit document accessibility and validate user isolation.

Verifying Document Access via Document Lookup

1. In the Glean Admin Console, navigate to Content management → Document lookup.
2. Paste the specific Document URL (e.g., a sensitive Google Doc URL or ID).
3. Under User (optional), select the specific teammate whose access you wish to test.
4. Click Check document.
5. Review the diagnostic output:
   • Last crawled: The exact timestamp when Glean last fetched document metadata.
   • Last indexed: The timestamp when content and ACL updates entered the live search index.
   • Document visibility on Glean: Indicates whether the document is active or administratively hidden.
   • Document access: Returns a definitive Allowed or Restricted status for the selected teammate, explaining whether access is granted via direct permission, group inheritance, or domain sharing.

Conducting Target Search Queries

Administrators and test users can validate connector health directly from the Glean search bar using diagnostic operators:

• app:gdrive <keyword>: Isolates search strictly to Google Drive.
• app:slack <keyword>: Isolates search to Slack RTS.
• * (asterisk): Returns all accessible items across the system for the current user, useful for confirming that restricted baseline documents are not exposed.

Reviewing Administrative Audit Logs

Glean maintains comprehensive tracking of administrative and system activities:

1. Navigate to Users & permissions → Audit logs (or Management → Audit Logs).
2. Filter events by timestamp, user, or action type (e.g., connector configurations, permission scope alterations, tool toggles).
3. Export logs to CSV for enterprise SIEM integration (Splunk, Datadog) to satisfy SOC 2, HIPAA, and ISO 27001 audit obligations.

6. Strategic Evaluation and Enterprise Implementation Checklist

Implementing workplace search with native ACL enforcement offers substantial architectural advantages over build-it-yourself retrieval-augmented generation (RAG) pipelines, which often struggle with document-level security.

Trade-offs to Consider

• Federated RTS vs. Full Indexing: Slack RTS ensures 100% native permission compliance and real-time accuracy with zero message storage overhead. However, it relies on Slack API quotas. For extremely large organizations with high query volumes, administrators must monitor Slack rate limits and ensure identity crawls complete smoothly to support Glean's ranking algorithms.
• Link-Sharing Governance: IT teams often discover that legacy Google Drive folders were over-shared with "Anyone in the company can view." Glean’s conservative default behavior—hiding domain-shared files unless previously visited, pinned, or explicitly marked "Can find in search results"—protects companies from accidental leaks.

IT Pre-Deployment Checklist

• Primary Identity Provider (Okta / Entra ID / Google) synchronized to Glean.
• GCP Service Account created with JSON key and unique OAuth 2 Client ID.
• Google Workspace Domain-Wide Delegation authorized with exact required scopes.
• Directory Admin email designated for Google Workspace activity crawling.
• Google Drive link visibility policy reviewed ("Can find in search results" settings).
• Slack Enterprise Grid connected by a verified Slack Org Owner.
• Slack Real Time Search (RTS) connector deployed and verified.
• Sensitive HR, legal, and executive channels redlisted or excluded by Channel ID.
• External Slack Connect channel protections confirmed.
• Document Lookup tested with sample executive and entry-level user accounts.
• SIEM audit log export pipeline verified.

By configuring Google Workspace and Slack through Glean’s dual-engine model, IT administrators establish a unified, intelligent workplace search environment where zero-trust data governance and employee productivity operate in complete alignment.

References

• Permissions
• Slack
• Slack Real Time Search (RTS)
• Access verification
• Troubleshooting Search
• Audit Logs
• Glean Trust Center