Project Atlas AetherDev project hub
Atlas project production

Google Group Expansion + 2SV Status Reporter

Expand nested Google Group membership into a sheet-backed 2SV roster used for security review and follow-up.

Internal-only entry. Do not publish externally without review.
Type
Component
Lifecycle
Active
Last touched
2026-03-24
Visibility
Internal

Purpose

Give administrators a practical reporting surface for nested group membership and two-step-verification follow-up inside the broader Google Workspace MFA enforcement workflow.

Current state

This is an active reporting component of Google Workspace MFA Enforcement and Reporting rather than a standalone integration record. It remains useful in production, but live run cadence, checkpoint or resume status, and current scale ceilings in Apps Script still need documentation.

Next step

Confirm the active trigger model, document retention expectations for output sheets, and record whether checkpoint or resume support is live or still a design gap.

Interfaces

Inputs
  • master group name
  • nested group memberships
  • directory user state
  • 2SV status
Outputs
  • expanded membership roster
  • 2SV status report tab
  • summary counts for follow-up

Reality to Action trace

Reality Ingestion

Contributes in this stage.

Canonical Storage

Not in scope.

Automation Engines

Not in scope.

Human Interfaces

Contributes in this stage.

Operational Adoption

Contributes in this stage.

Core workflow

TBD. Document the 5-10 steps that define the core workflow.

Data integrity and contracts

Source of truth rules

  • Google Directory is canonical for group membership and 2SV state.
  • The report sheet is the operational reporting surface, not a system of record.

Safe handling

  • Restrict report sheets to approved admins.
  • Avoid exporting 2SV rosters beyond internal review workflows.
  • Use admin scopes only for the duration and scope of the run.

Operational notes

Reliability posture

The workflow is useful in production, but large runs remain sensitive to Apps Script execution limits and need either checkpointing or smaller scopes.

Observability

  • Apps Script logs
  • sheet output tabs
  • progress markers or checkpoint state when implemented

Security and privacy

Group membership and 2SV state are restricted identity-governance data. Keep report sheets internal and admin-only.

Dependencies

Upstream
  • Google Workspace admin access
  • Apps Script runtime limits
  • group-scope selection
Downstream
  • MFA follow-up
  • security review and compliance reporting

Ownership

Owners

Technology Services, Josh Barton

Users

Technology Services, security reviewers

Google Group Expansion + 2SV Status Reporter

Operational Notes

  • The live use case is reporting and review, not enforcement. The workflow recursively expands nested groups, enriches member state with 2SV status, and writes an internal sheet used for security follow-up.
  • The registry now treats this as a production reporting workflow rather than a design sketch. What is still missing is the run-trigger inventory: which groups are reviewed on a schedule, which are run ad hoc, and who owns retention of the generated sheets.
  • Apps Script limits still matter. Large nested groups remain the main scaling constraint, so checkpointing or scoped reruns should be documented before this is treated as infinitely scalable.

Output Model

  • Expanded membership roster tab for the selected group scope.
  • 2SV status report tab used for follow-up and compliance review.
  • Summary counts or checkpoint markers for operators when the run is large enough to need partial reruns.

Registry Alignment

  • Former standalone registry entry INT-007 is now merged into Google Workspace MFA Enforcement and Reporting under INT-006.
  • Registry clarified: Atlas keeps this page as the component-level technical record for nested-group expansion and 2SV reporting inside the parent MFA workflow.
  • Validation gaps: live run cadence, checkpoint or resume implementation status, group-scope inventory, and output-sheet retention rules still need documentation.