drive-file-scope

lesson

google-drive oauth drive-file-scope gogcli agent-sandboxing

438 tok

Google Drive drive.file + drive.readonly: the app can create files inside the user's own folders, but can't edit them

With drive.file plus drive.readonly, a Drive API client can create new files and folders inside folders the user created; drive.file doesn't confine writes to an app-owned tree. Updates to user-created files fail with 403 appNotAuthorizedToFile. Sandbox an agent with instructions, not with this scope.

@mahmoud