48 Reading-room enclave (SCIF port, incl. data-copy minimization)

Caveats

• Selecting an access level puts it in Monitor mode by default — the enclave is not gated until you check the Active box, and this is the single most common way this control ships broken.
• Download/copy/print restriction is not DRM — a phone camera pointed at the screen defeats the whole enclave, which is why the physical reading-room half of the control matters.
• Enterprise Standard+, Education Standard+, Frontline Standard+ and Enterprise Essentials Plus for the DLP and CAA layers — on a Business tier the stack degrades to sharing settings alone, which is not an enclave.

Setup steps

1. 1. Put the enclave members in their own OU (organizational unit) and take external sharing away from it entirely — the enclave's whole premise is that content cannot leave.
   open ↗

   

   https://admin.google.com/ac/managedsettings/55656082996/sharing · captured 2026-07-15

   Apps › Google Workspace › Drive and Docs › Sharing settings

   Sharing outside the organisation

   OFF

   Allow users to receive files from outside

   OFF

2. 2. Create the enclave shared drive and strip the copy/download/print capability from viewers and commenters — this is the data-copy minimization half of the control.
   open ↗

   

   https://admin.google.com/ac/list/shareddrives · captured 2026-07-15

   Apps › Google Workspace › Drive and Docs › Manage shared drives

   Allow people who aren't shared drive members to be added to files = OFF; Allow viewers and commenters to download, print, and copy files = OFF; Allow users outside your organization to access files in shared drives = OFF

3. 3. Apply the enclave label to the drive's contents so DLP has something to key on.
   open ↗

   

   https://admin.google.com/ac/dc/labels · captured 2026-07-15

   Security › Access and data control › Label manager

   Create a label (e.g. 'Sensitivity') with a 'Restricted (enclave)' option in Label manager and apply it

4. 4. Add the egress rule: any share, download, or Chat/Gmail attachment of enclave-labelled content is blocked and alerted.
   open ↗

   

   https://admin.google.com/ac/dp · captured 2026-07-15

   Security › Access and data control › Data protection

   Condition

   Label = Restricted

   Action

   Block

   Alert

   High severity

5. 5. Bind Drive access for the enclave OU to the reading-room access level (managed device + reading-room IP), then check the Active box to take it out of Monitor mode.
   open ↗

   

   https://admin.google.com/ac/security/context-aware · captured 2026-07-15

   Security › Access and data control › Context-Aware Access

   App

   Drive

   Access level

   reading-room

   Mode

   Active (not Monitor)

Ongoing maintenance

• requires a human Quarterly: review the enclave access list and expire finished engagements.

How to verify

1. As an authorised test user inside the enclave, attempt to download, print, and copy from a protected document — every path must be refused; then attempt access from outside the enclave context — it must be denied entirely.