Atlas project production

Google Workspace Group Membership Maintenance Automation

Maintain selected Google Group memberships and manager roles through the current GAM-based runner, with a newer Rust guard path under validation.

Internal-only entry. Do not publish externally without review.

Type: System
Lifecycle: Active
Last touched: 2026-03-25
Visibility: Internal

Purpose

Keep selected district Google Groups aligned to OU rules and approved manual membership exceptions without repeated manual admin edits.

Current state

Registry and workbench evidence show a dual-path state: the GAM-based `Push-GoogleGroupsModify.sh` path has explicit cron cadence (hourly at :30 from 07:00 to 18:00), while `google-groups-guard` exists as a stronger guarded plan/apply implementation that may supplement or replace parts of the legacy path.

Next step

Confirm which runtime is authoritative in production, then document groups in scope, approval owners, rollback procedures, and any retained role for the Rust guard workflow.

Interfaces

Inputs

Google Workspace directory state
OU membership queries
manual inclusion and manager rules

Outputs

updated Google Group memberships
updated manager assignments
script run output

Reality to Action trace

Reality Ingestion

Contributes in this stage.

Canonical Storage

Not in scope.

Automation Engines

Not in scope.

Human Interfaces

Contributes in this stage.

Operational Adoption

Contributes in this stage.

Core workflow

TBD. Document the 5-10 steps that define the core workflow.

Data integrity and contracts

Source of truth rules

Google Workspace directory and OU structure are canonical for automated membership decisions.
Manual inclusion lists are the authoritative exception layer for groups that do not map cleanly to OU rules.

Safe handling

Restrict admin credentials and rule lists to approved operators.
Treat membership exports and rule files as internal identity-governance data.
Record group-scope and approval ownership in an internal runbook.

Operational notes

Reliability posture

Production-active through the GAM runner with known cadence, while a newer plan/apply Rust path exists; authoritative runtime ownership and rollback runbooks still need consolidation.

Observability

script stdout/stderr
GAM command output
visible membership drift when runs fail

Security and privacy

Group membership and manager assignments are restricted identity-governance data and should stay internal.

Dependencies

Upstream

Google Workspace admin access
accurate OU structure
maintained manual inclusion lists

Downstream

district communications groups
access and audience scoping

Ownership

Owners

Technology Services

Users

Technology Services, communications stakeholders

Google Workspace Group Membership Maintenance Automation

Operational Notes

The workflow uses GAM-driven OU queries plus manual inclusion lists to enforce group membership and manager roles.
Current evidence indicates live GAM scheduling plus adjacent Rust guard tooling. Treat cutover status as unresolved until host-level runtime ownership is documented.
Related reporting surface: Google Group Expansion + 2SV Status Reporter.

Registry Alignment

Mapped registry entry: INT-076.
Registry clarified: group enforcement is an active workflow, but runtime is now best modeled as legacy GAM enforcement plus a newer guard-based implementation path.
Validation gaps: primary runtime ownership, groups in scope, approval model, and rollback expectations still need explicit documentation.