65 Travel-mode accounts

draft

For a border crossing or a trip into a hostile jurisdiction, the traveller carries a sanitised identity: a travel account or travel OU with no admin roles, no Vault, no sensitive shared drives, a geo-restricted access policy and a short session. Access is granted by group, so moving the person between groups is the whole switch. The primary identity is suspended for the duration where the trip allows it, and its sessions and tokens are revoked on return before membership is restored.

Caveats

The runbook must be executable by someone other than the traveller — they may be detained, offline or coerced at the border.

Setup steps

Pre-create a travel identity (or a travel OU — organizational unit) whose access is a strict subset: no Vault, no admin, no sensitive shared drives.

Travel OU: Context-Aware Access geo policy (Enterprise Standard+, Education Standard+, Frontline Standard+, Enterprise Essentials Plus and Cloud Identity Premium; silently ignored on other editions) + short session length + no admin roles

Protect your business with Context-Aware Access Set session length for Google services
On departure, swap the traveller out of the sensitive groups and into the travel group — access is by group, so the swap is the whole control.
open ↗

https://admin.google.com/ac/groups · captured 2026-07-15

Directory › Groups
```
gam update group sensitive-team remove member user@…
gam update group travel add member user@…
```
Add or invite users to a group Remove or ban users from a group
Suspend the primary identity for the duration if the traveller does not need it, and restore on return.
open ↗

https://admin.google.com/ac/users · captured 2026-07-15

Directory › Users
```
gam update user user@… suspended on|off
```
Suspension does not kill live sessions or issued OAuth tokens — revoke them explicitly, or the 'suspended' account keeps working.

Suspend a user temporarily Restore a suspended user
On return, force re-auth and revoke all existing sessions/tokens before restoring group membership.
```
gam user user@… signout
gam user user@… deprovision   # revokes tokens, app passwords and backup codes
```
Sign a user out of a managed Google Account

Ongoing maintenance

automatable: script Per trip: provision the travel account before departure and destroy/rotate it on return.
requires a human Per trip: brief the traveller and confirm the primary account lock.

How to verify

Before a trip: confirm the travel account holds only the trip’s data, sits in the travel OU with its tighter CAA level, and the traveller’s primary account is suspended or locked for the duration.

draft v0.1.3 Prevent policy #25 · #14, #30 ↗