Gemini in Google Workspace: settings and controls

By the ninth session, the question Sofia hears most from department heads is not about mail or files. It is about Gemini, Google's AI assistant. Marketing wants it to draft product descriptions, Finance wants it to summarize long supplier contracts, and Teresa wants to know exactly what it can see before anyone uses it. Since early 2025, Gemini features have been included in Workspace Business and Enterprise editions rather than sold as a separate add-on, so Birchline's Enterprise Standard licences already include them. "That means it's on unless we decide otherwise," Sofia says. "So we decide." This lesson covers where Gemini appears, the controls administrators have, what happens to the data it uses and Birchline's rollout plan.

Where Gemini appears

Gemini shows up in two ways. Gemini in Workspace apps works inside Gmail, Docs, Sheets, Slides, Drive, Meet, Chat and Calendar: drafting and summarizing messages, writing and rewriting text, building tables and formulas, creating images for slides, summarizing files in Drive and taking notes in meetings. The Gemini app, at gemini.google.com and in mobile apps, is a conversational assistant that users sign in to with their work accounts, which can also reach Workspace data such as Gmail and Drive when that access is allowed. Related tools include NotebookLM, which answers questions from documents a user adds, and newer agent and automation features that Google has been adding to Workspace.

The column that matters most to Teresa is the last one. Gemini in Workspace works with the user's own access: it can summarize a file only if the user could open that file anyway. That is reassuring and also exposes old problems. If a confidential spreadsheet was shared with the whole organization by mistake years ago, Gemini will happily summarize it for anyone who asks, which is why the sharing review from lesson 6 comes before the Gemini rollout, not after.

The controls administrators have

Gemini settings live under the Admin console's Generative AI section. Administrators need the relevant Gemini settings privilege to change them, which at Birchline will belong to Sofia and Teresa only.

• Feature access for Gemini in Workspace services: an on or off switch for each service group (Gmail; Calendar; Drive and the Docs editors; Meet; Chat and some others), applied to an OU or a configuration group. The default is on for editions that include the features. Where both an OU setting and a configuration group setting apply to a user, the group setting takes precedence.
• Gemini app access: whether users can use the Gemini app with their work accounts, and separately whether the Gemini app may connect to Workspace apps such as Gmail and Drive.
• Conversation history for the Gemini app: whether users' conversations are saved and for how long, within the options Google offers.
• NotebookLM and other related services: on or off like other services.
• Smart features and personalization: Gemini features in Workspace apps depend on users having these turned on, and administrators can set the default.

One detail surprises Owen. Turning Gemini off in one app does not stop users from reaching that app's data through Gemini in another app; for example, with Gmail's Gemini features off but the Gemini app allowed to connect to Gmail, a user can still ask the Gemini app about their mail. To keep Gemini away from a service's data entirely, the related connections must be turned off too. Owen draws the settings as a grid, so the combinations are visible before the rollout.

# Planned settings for one user, as Owen draws them in his grid.
in_app = {"Gmail": False, "Drive and Docs": True, "Meet": True}   # Gemini feature access per service
gemini_app = True                                               # Gemini app allowed
app_connections = {"Gmail": True, "Drive and Docs": True}       # Gemini app may reach these apps

for service in in_app:
    routes = []
    if in_app[service]:
        routes.append("Gemini inside " + service)
    if gemini_app and app_connections.get(service, False):
        routes.append("the Gemini app")
    reach = " and ".join(routes) if routes else "no Gemini feature"
    print(f"{service:15} data reachable through: {reach}")

Gmail           data reachable through: the Gemini app
Drive and Docs  data reachable through: Gemini inside Drive and Docs and the Gemini app
Meet            data reachable through: Gemini inside Meet

The grid confirms the point: Gmail's in-app Gemini is off, but the user can still ask the Gemini app about their mail, because the app's Gmail connection is on. Meet's data is reachable only inside Meet, since the app has no Meet connection in this plan. Owen copies the grid into the rollout plan with one row per stage, so that each change to the console can be checked against what the stage is meant to allow.

Meeting notes and consent

Meet's note-taking feature, which writes a summary of the meeting to a Doc, raises the same questions as recording in lesson 7. Participants see an indicator when notes are being taken, and administrators can turn note-taking on or off separately from other Gemini features. Birchline's People and culture team asks that notes never be taken in interviews, disciplinary meetings or medical accommodation discussions, and that notes from other meetings be checked by the organizer before they are shared, because a summary can misattribute who said what. The rule joins the recording policy in the staff guide, and the setting stays off for the People and culture OU until the team asks for it.

Translated captions and other Meet AI features follow the same edition and setting rules. Owen notes that features appear and change often, so the console, not last year's training slides, is the source of truth for what is available.

Data protection

For Workspace customers, Google states that content users work with through Gemini is not used to train its models outside the customer's domain without permission and is not reviewed by people for that purpose, that Gemini respects the existing access controls and sharing on each file, and that the data protections of the Workspace agreement apply. Teresa's team has read Google's published privacy commitments for Gemini in Workspace and the Workspace data processing terms, and her summary for the legal team uses those documents' wording rather than vendor slides. She also records which features send data to services that might be processed outside Canada, because Workspace data regions (from the first course) cannot pin data to Canada, and Birchline's privacy notice must describe that honestly.

Gemini app conversations and some Gemini activity can be retained and searched with Vault in supported editions, so they fall under the same retention and legal hold rules as mail and chat (GCP-212). Teresa wants that confirmed in Birchline's console before the Gemini app is opened to Finance.

Birchline's rollout plan

Sofia's plan is staged, like every other change, and starts with the people whose work is least sensitive.

Before stage 1, Owen turns feature access off for the top-level organization, then on for the /Pilot OU, so that nobody outside the pilot gets Gemini by default when head office moves in February. Stage 2 uses a configuration group, cfg-gemini-early, because Marketing and E-commerce sit in different OUs; the group setting takes precedence over the OU setting, so adding someone to the group turns Gemini on for them even though their OU has it off.

The plan for stores is deliberately open. Frontline editions differ from Enterprise ones in which AI features they include, and Google has been changing the line-up, so Owen will check the current edition comparison when operations makes a case. Possible uses, such as summarizing the store operations manual or drafting incident reports, are real, but so is the training effort for 800 people on shared tablets.

Usage guidelines

Settings cannot decide whether a particular use is wise. Birchline's guidelines, drafted by Teresa and the legal team, are short: Gemini drafts, people decide; check facts and figures before sending; do not paste customers' card numbers or other people's personal health information into prompts; label AI-generated product images as such where the law or Birchline's brand rules require it; and report outputs that look biased or wrong. The guidelines sit on the intranet and are linked from the pilot's welcome message. They also explain the help desk's position: Gemini questions are support questions like any other, and the help desk will not judge whether someone should have used it.

Checking what is happening

Administrators can see Gemini usage in the Admin console's reports, including how many users have used Gemini features in each app, and audit events for Gemini settings changes are recorded like other admin events. For stage reviews, Sofia will look at three things: adoption (how many pilot users used Gemini in a week), help desk tickets about Gemini, and the sharing problems the summaries exposed, if any. The last one is the most useful: each oversharing problem found because a summary showed something unexpected is a problem fixed before the whole company could see it.