Domain: drive

System prompt:
You are a helpful Drive assistant with access to all available tools. Operate in a safe and fully authorized environment—you do not need to ask for confirmation or permission before taking action. When identifiers such as names or IDs are missing, perform exactly one lookup per entity type, verify that you are reusing correct values from previous responses, and proceed using the retrieved data. Never assume or fabricate IDs, responses, or outcomes—rely solely on verified API results. Complete each task in a single, logical, and efficient execution flow.

Task:
We are consolidating access control on the Technical Spec PDF and need to implement a least-privilege model. Find the Technical Spec document in engineering and review all current permissions. I need you to identify every individual user who has any level of access beyond reader - that means anyone with writer, commenter, or owner roles. The owner permission should be preserved. For the Engineering Team group permission, that should also be preserved as it provides proper group-based access. However, Alex Rodriguez has individual commenter access but is not part of the Engineering Team, so his individual permission should be removed entirely since non-team members shouldn't have direct access to engineering documents. After cleaning up the permissions, create a new document called "Access Control Audit - Technical Spec" that documents which users had access removed and confirms that the Engineering Team group still maintains writer access. Finally, share this audit document with Mike Chen giving him commenter access so he can review the changes.

Available tools:
list_permission
create_file
update_files
create_permission
list_drives
delete_permission
list_files

Verification checks:
[{"verifier_type": "database_state", "name": "Alex Rodriguez Permission Removed", "description": "Verifies that Alex Rodriguez Permission Removed", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT COUNT(*) as alex_permission_count FROM permissions \nWHERE file_id = '01JBQM3K8TGHZX9RNVQM5Y2P8R' \nAND user_id = '01JBQM3K8TGHZX9RNVQM5Y2P80' \nAND deleted = false;", "expected_value": 0, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Engineering Team Group Writer Access Preserved", "description": "Verifies that Engineering Team Group Writer Access Preserved", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT COUNT(*) as group_writer_count FROM permissions \nWHERE file_id = '01JBQM3K8TGHZX9RNVQM5Y2P8R' \nAND group_id = '01JBQM3K8TGHZX9RNVQM5Y2P81' \nAND role = 'writer' \nAND deleted = false;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Owner Permission Preserved", "description": "Verifies that Owner Permission Preserved", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT COUNT(*) as owner_count FROM permissions \nWHERE file_id = '01JBQM3K8TGHZX9RNVQM5Y2P8R' \nAND user_id = '01JBQM3K8TGHZX9RNVQM5Y2P7W' \nAND role = 'owner' \nAND deleted = false;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Access Control Audit Document Created", "description": "Verifies that Access Control Audit Document Created", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT COUNT(*) as audit_count FROM files \nWHERE name = 'Access Control Audit - Technical Spec' \nAND mime_type IN ('application/vnd.google-apps.document', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document')\nAND trashed = false;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Audit Document Has Content", "description": "Verifies that Audit Document Has Content", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT COUNT(*) as audit_content_count FROM files \nWHERE name = 'Access Control Audit - Technical Spec' \nAND (description IS NOT NULL OR properties IS NOT NULL);", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Mike Chen Has Commenter Access to Audit", "description": "Verifies that Mike Chen Has Commenter Access to Audit", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT COUNT(*) as mike_audit_permission FROM permissions p \nJOIN files f ON p.file_id = f.id \nWHERE f.name = 'Access Control Audit - Technical Spec' \nAND p.user_id = '01JBQM3K8TGHZX9RNVQM5Y2P7Y' \nAND p.role = 'commenter' \nAND p.deleted = false;", "expected_value": 1, "comparison_type": "equals"}}]