Workspace Routing Rules
Last updated
Last updated
Establish a rule-based key routing mechanism for Google Workspace that automatically determines which workspace key is used to encrypt files, based on predefined conditions such as file name, user, or application.
This ensures that data is consistently encrypted with the correct key according to organizational policies, without relying on user decisions.
Allow Organization Admins to define routing rules that control how files are encrypted across shared workspaces and individual user workspaces.
Ensure encryption key selection is fully automated based on rule priority and matching conditions, eliminating manual intervention and reducing misconfiguration risks.
Support isolation of:
Project-level data into project-specific workspaces
Personal or sensitive drafts into Individual Workspaces while maintaining enforceable access boundaries.
Rules are evaluated strictly by priority order (ascending).
The first matching Active rule is applied.
Archived rules are skipped but retain their priority number for audit consistency.
Routing is applied at the workspace level, not per key.
Per-rule key override inside the same workspace is not supported in MVP.
Set default rule for routing
Create new rule
Edit rule
Enable/Disable rule
Once a routing rule is created and active, all subsequent Google Workspace encryption operations are evaluated against the rule engine.
Applies regardless of who creates the file.
End users are not exposed to routing logic or workspace selection.
All decisions are enforced at the Oten KMS layer.
Rule creation, edits, deactivation, and runtime fallback events are recorded for audit and compliance purposes.
If a rule target cannot be applied at runtime, the system falls back to:
This ensures encryption never fails silently.
The next valid rule, or
The Org Default Workspace
