Workspace Studio enables users to boost their productivity with custom, no-code agentic automation. Today, we are adding a new set of enterprise security controls to enable additional collaboration use cases. These granular identity, data protection, observability, and governance controls provide admins with more confidence to safely enable and adopt agentic capabilities in their organization.Built-in, enterprise security controls in Workspace Studio include:Agent identitiesAgent access managementAgent auditing and observabilityAdmin settings / human-in-the-loop (HiTL)Runtime protectionsCollaboration use casesWhen Studio initially launched, it was only able to assist users in their tasks, such as drafting an email, not executing tasks autonomously, such as sending an email. Now, Studio supports cross-user collaboration through the introduction of several new steps with built-in guardrails.Collaboration actions in Studio FlowsAgent identities: Automation with flows in Studio will continue to run with the user’s identity, but in a least-privileged way. This means that the flow will have the minimal set of privileges required to run, and not the full set of privileges the owner has. When the flow executes, it will do so with a unique, auditable identifier. Note: the least-privilege agent identity will apply to newly created flows only.  Existing flows will be supported in the future.(Beta) Identity attribution: Admins, through a new setting, will be able to decide whether the actions taken by a flow show the owner’s identity, or are attributed to the flow itself, with the owner information made visible.  This will default to “on”; meaning the actions by the flow will be attributed to the flow. Note: the agent identity attribution setting will apply to newly created flows only.  Existing flows will be supported in the future.Flow represented as the owner’s identity”
Flow attributed as the flow’s name with owner’s informationAuditing and observability: Actions in Studio across configuration and execution events are recorded in Studio audit events. Additionally, audit events for actions, such as edits made to a file in Drive or emails sent in Gmail, will include flow context, such as a unique flow identifier and the owner’s information. Note: agent context in audit logs will apply to newly created flows only. Existing flows will be supported in the future.Agent access management: In the admin console, an Agent access management dashboard gives admins the ability to suspend all flows or targeted OAuth scopes for individual flows, such as revoking Drive access. Additionally, the security investigation tool enables admins to transition directly from an audit event to the agent access management page, facilitating swift remediation during incident investigations. Note: after the rollout, newly created flows will be shown in Agent access management.  Existing flows will be supported in the future.Agent access management dashboardAdmin settings & human-in-the-loop: Additional admin settings will support disabling specific step types for flows, disabling Gemini data access, enforcing end-user confirmation for steps that share data externally, and disabling webhook integrations.Flow asking for human approval before it sends an email externallyRuntime protections: Additional data loss prevention (DLP) features for Gemini data access and Studio flows are available for added protection. Gemini DLP restricts Gemini’s ability to access Drive data based on content conditions and labels, with support for additional services coming soon. Agent DLP will support restrictions on Studio flow execution, including blocking or enforcing end-user review, based on conditions of the sourced data, utilized data, and data visibility of the output.Studio DLPRollout paceAdmin console settingsRapid and Scheduled Release domains: Rollout starting today (up to 3 days for visibility)End-user visible featuresRapid Release domains: Rollout starting August 20, 2026 (up to 3 days for feature visibility).Scheduled Release domains: Gradual roll out (up to 15 days for feature visibility) starting September 1, 2026 (Beta) Identity attributionRapid Release domains: Rollout starting today, over a gradual period of 7 daysScheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting August 24, 2026Getting startedAdmins:Workspace Studio set up guide for adminsSee a list of all flows and manage data accessManage flow attribution visibilityRequire user approval for sensitive stepsSet up DLP for AgentsSet up DLP for Gemini Data AccessEnd users: Once available, end users can access the steps by visiting https://studio.workspace.google.com/AvailabilityAvailable for Google Workspace*:Business Starter,  Standard, and PlusEnterprise Starter, Standard, and PlusEducation Fundamentals, Standard, and PlusAlso available to*:Google AI Pro for EducationGoogle AI Ultra for Business* Gemini DLP, and DLP for Studio are available only for Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus