View Google CSE Files Wrapped by Workspace Key

Objective

Establish a transparent visibility and governance layer for Google Client-Side Encrypted (CSE) files by allowing workspace users to view and manage Google Drive files encrypted with workspace-managed keys, without breaking Google’s native ownership and access model.

Function Purpose

Centralized Visibility: Allow workspace users to see all Google Drive files that are encrypted using Google CSE and wrapped by keys they have access to, regardless of file ownership or sharing source.

Key Transparency: Provide clear insight into encryption details, including which key, key version, and workspace are responsible for protecting each file.

Controlled Re-encryption: Enable authorized users to re-wrap files with a different workspace key, ensuring encryption policies remain aligned with workspace governance and data classification needs.

Current MVP Limitation

Metadata-Only Scope:

• The system only reads Google Drive file metadata via Google OAuth.

• File content is never accessed or decrypted by Oten KMS.

CSE-Only Visibility:

• Only files encrypted with Google Client-Side Encryption are listed.

• Non-CSE files are excluded from the view.

Permission-Bound Actions:

• Cross-workspace visibility is limited to keys the user already has access to.

Once authenticated via Google OAuth, the system will automatically:

No additional configuration is required from workspace users. Re-wrap operations, if permitted, are executed through Google CSE and fully audited.