GDrive API Privacy UAT for GDrive Sensor

[JEJodesty]

UAT Goal:
Only the GDrive Sensor’s Principles can share files & folders to be “Sensed” (Ingested by the GDrive Sensor)

• GDrive Sensor’s Principles are Google (Drive) Accounts authorized by GDrive Sensor’s GCP Project that administrate GDrive Sensor’s Service Account

UAT Acceptance Criteria:
Sensor cannot ingest a Google Account’s personal files that is not shared with a Principal or the Organization
A Principal cannot share personal files with a Google Account’s Drive for Sensing that wasn’t already shared with them or the Organization.

Context:
The GDrive Sensor's Service Account's purview is of Files & Folders & Shared Drive shared with it by Principals (GDrive GCP Project Owners & Editors)

• There is not a Single Drive for the entire Organization, just Shared Drives, Folders, & Files
• Only Principals can share Files, Folders, & Drive within the purview of personal Drives which includes Drives, Folders, & Files shared with them
  • Principals can but should not can share their entire personal Drives which can only be done with the assistance of the API
• As of now, Non-Principals would have to move File & Folder to a Folder or Drive shared with the Service Account by a Principal until blacklisting and/or their permissions are scoped.