Required Google Update: Prepare your AODocs libraries for the transition to Google Drive's "Limited Access" model – AODocs Knowledge Base

The essentials, in one paragraph

Google is changing the way permissions work in Google Drive, and is about to retire a mechanism (the Negative ACLs) that AODocs has relied on for many years to enforce granular, document-level access controls. This change is industry-wide: it affects every tool built on top of Google Drive and which interacts with its permissions, not just AODocs. We have been working closely with the Google Drive team to update our software in a way that protects your data, preserves as much of your existing configuration as possible, and gives you clear choices where a choice is required. Your AODocs libraries of the Document Management System (DMS) type are not impacted. However, your Secured Folders and Team Folders will have to be updated. To request an on-demand solution instead of the default, open a support ticket by May 7, 2026. Starting May 15, 2026, Google will retire Negative ACLs (the Google Switch), and AODocs will apply the related updates to Secured Folders and Team Folders libraries. Please read on carefully.

1. What is changing on the Google Drive side

1.1 The new “Limited Access” model

Google Drive is changing the way access permissions propagate from a parent folder to the subfolders and files it contains: some configurations where a folder or file's access is more restricted than their parent folder will no longer be possible:

Today - “Negative ACLs”: a subfolder or file can be stripped of a permission it would otherwise inherit from its parent. For instance, in a folder “A” shared with All Employees, an “HR Files” subfolder can be hidden from everyone except the HR team, and a specific file inside “HR Files” can be hidden from the HR team, except its owner.
Tomorrow - “Limited Access”: removing an inherited permission will no longer be possible. Instead, Google has introduced a “Limited Access” checkbox, which prevents a folder from inheriting any permission from its parent. A folder with “Limited Access” enabled starts with a blank list of permissions and is shared only with the people or groups explicitly added to it. Google's documentation on Limited Access is available at: https://support.google.com/drive/answer/14254362?hl=en.

The Limited Access mechanism only applies to folders. It is not available for individual files. In practice, once the Negative ACLs mechanism will be discontinued by Google, it will no longer be possible to isolate a single file inside a folder whose other files remain broadly visible. Isolating a file would require moving it into a dedicated subfolder with “Limited Access” enabled.

The chart below summarises the Google Drive permission change:

1.2 How Google will convert your existing permissions when Negative ACLs are no longer supported

As part of the switch to the new permission model (that is, deprecating the Negative ACLs model with only the Limited Access model surviving) (the “Google Switch”), Google will convert Negative ACLs into “Limited Access” flags. In other words, Google will apply a "Limited Access" flag to the folders and files whose permissions are currently restricted relative to their parent folder (i.e., the folders and files that today rely on Negative ACLs) (the “Google Conversion”). Folders and files that inherit their permissions normally are not affected by this step. Note that Google is the only party that can set this flag on individual files.

Importantly, this Google Conversion will not change who has access to your individual files and folders. The same users and the same groups will have the same access to each file and folder before and after the Google Conversion - the operation is designed to preserve existing permissions, not to redefine them.

The Google Switch is currently expected on May 15, 2026. We are continuing to discuss with Google to seek to defer the deadline as long as possible, and we will notify you promptly in case of any change.

2. Why this impacts your AODocs libraries and what you can do about it

AODocs provides several ways to set permissions on AODocs documents (based on the document's class, based on the document's workflow state, based on the document's parent folder or simply using explicit, manually configured permissions on each document). When an AODocs document has attached files in Google Drive, AODocs applies its permissions to the attached files in Google Drive.

When an AODocs document's permissions are not based on its parent folder's permissions, AODocs may need to set Negative ACLs on its attached files, which will become impossible after the aforementioned Google Switch. Depending on the type of AODocs libraries you use, the configuration of your AODocs libraries may have to be updated.

2.1 Team Folder libraries

After the Google Switch, AODocs users will no longer be able to use the AODocs user interface to set permissions in a Team Folder library. It will only be possible to set permissions from the Google Drive interface. Depending on the configuration of your Team Folder library, you might want to turn it into a Secured Folder library. See section 3 for more details on the impact on Team Folder libraries.

2.2. Secured Folder libraries

Secured Folder libraries are the most impacted by the Google Switch. If your Secured Folder library uses AODocs class- or workflow-based permissions, it will no longer be possible to keep the folder structure visible in Google Drive. If your Secured Folder library uses only Google Drive folder-level permissions, AODocs will mirror the new model internally (the “ignore inherited permissions” flag in AODocs will adopt the same behavior as the “Limited Access” flag in Google Drive). On-demand solutions can be requested instead of the default. See section 4 for more details on the impact on Secured Folder libraries.

2.3 DMS libraries

Since DMS libraries do not use any Google Drive folder structure, these libraries won't be impacted by the Google Switch. There is nothing you have to do for these libraries.

3. If you have Team Folders libraries

We have defined a default solution that will apply automatically, and an on-demand solution that you can request if the default does not suit your needs. The default solution is designed to preserve your existing permissions. However, it will change how certain permission-related actions work going forward, and you should understand those changes.

3.1. Default solution - Team Folders preserved, permission management no longer available in the AODocs user interface

Your Team Folders libraries will remain Team Folders. Your existing permissions will be preserved as-is: the Google Conversion will apply “Limited Access” flags to the files and folders that currently have restricted permissions, so users and groups who can access a file today will still be able to access it tomorrow, and users and groups who cannot access it today will still be unable to access it tomorrow.

Important warning. If admins or users remove the “Limited Access” flag from an individual file (as opposed to a folder), the “Limited Access” flag cannot be reapplied afterwards: removing the “Limited Access” flag on an individual file is irreversible.

The key operational change is this: going forward, setting permissions on files will no longer be possible from the AODocs interface on Team Folders libraries. All permission management will happen directly in Google Drive. Concretely, this means that:

Permissions will be driven exclusively by the Google Drive folder hierarchy. For Team Folders libraries configured with class-based and workflow-based permissions, AODocs will stop applying future permission changes related to these settings.
It will no longer be possible to detach document-level permissions in AODocs (i.e., to “block” the inheritance of permissions on a single document).

No action is required from you for this default solution: it will be applied automatically further to the Google Switch. We expect it to be appropriate for the vast majority of Team Folders use cases.

3.2. On-demand option - switch to Secured Folders

If your Team Folders library is configured so that documents inherit their access permissions from their AODocs document class or from their workflow state, and if preserving those matters more to you than keeping the folder structure visible in Google Drive, we can convert the applicable Team Folders library to Secured Folders with private visibility (folder structure not visible in Google Drive while it remains visible in AODocs). To request this switch, please open a support ticket before May 7, 2026 (https://support.aodocs.com/hc/en-us/requests/new).

If you do not open a support ticket to request an on-demand solution before said date, we will proceed with the default solution as described in section 3.1. for each of your Team Folders libraries.

4. If you have Secured Folders libraries

Your situation depends on how your Secured Folders library is configured today. In each case, we have defined a default solution that will apply automatically, and an on-demand solution that you can request if the default does not suit your needs. In every case, the default solution is designed to preserve your existing permissions. However, it will change how certain permission-related actions work going forward, and you should understand those changes.

4.1 If your Secured Folders library uses only Google Drive folder-level permissions

Default solution - stay on Secured Folders with public visibility

Your Secured Folders libraries will remain Secured Folders with public visibility, i.e., the folder structure will be visible on Google Drive. Your existing permissions will be preserved as-is: the Google Conversion will apply “Limited Access” flags to the files and folders that currently have restricted permissions, so users and groups who can access a file today will still be able to access it tomorrow, and users and groups who cannot access it today will still be unable to access it tomorrow.

The key change at the AODocs level is that AODocs will mirror the new Google Drive permissions model internally (the “ignore inherited permissions” flag in AODocs will adopt the same behavior as the “Limited Access” flag in Google Drive). Concretely, this means that:

In a Secured Folder library for which the folder structure is visible in Google Drive, document permissions can only be inherited from the Google Drive folder hierarchy: it will no longer be possible to configure the document permissions to be inherited from the AODocs document’s class or the AODocs document’s workflow state.
It will no longer be possible to detach document-level permissions in AODocs (i.e., to “block” the inheritance of permissions on a single document).

No action is required from you for this default solution: it will be applied automatically further to the Google Switch.

On-demand option - switch to Secured Folders with private visibility

If you prefer not to rely anymore on Google Drive folder-level permissions, we can convert the AODocs library to Secured Folders with private visibility (folder structure hidden in Google Drive, but visible in AODocs). To request this switch, please open a support ticket before May 7, 2026 (https://support.aodocs.com/hc/en-us/requests/new).

If you do not open a support ticket to request an on-demand solution before said date, we will proceed with the default solution as described above for each of your Secured Folders libraries using only Google Drive folder-level permissions.

4.2 If your Secured Folders library uses AODocs class- or workflow-based permissions

Default solution - switch to Secured Folders with private visibility

As explained before, after the Google Switch, AODocs will no longer be able to apply AODocs workflow-based or class-based permissions on files that are contained in a Google Drive folder. Because of this, to continue to apply the permission model that is configured in your AODocs library, we will have to make your AODocs library's Secured Folder structure private, i.e., your AODocs folders will no longer be visible in Google Drive.

Once your folders have been switched to private visibility, your AODocs permission rules will continue to operate exactly as they do today.

No action is required from you for this default solution: it will be applied automatically further to the Google Switch.

On-demand option - keep Secured Folders with public visibility and adapt your permission model

If keeping the folder structure visible in Google Drive is important to you, preserving that visibility will require switching your AODocs library's permission model so that document permissions are inherited from the Google Drive parent folder rather than from the AODocs workflow state or the document class. AODocs class- and workflow-based permission rules will no longer apply in this AODocs library. To request this switch, please open a support ticket before May 7, 2026 (https://support.aodocs.com/hc/en-us/requests/new).

5. Timeline

Our current working calendar is the following:

As of today, we have removed the possibility to change the permission inheritance settings of a Team Folder library in the AODocs interface. The only possible inheritance is from the Google Drive folder.
Until May 7, 2026, you can ask for the on-demand option for your library, by creating a support ticket using this URL: https://support.aodocs.com/hc/en-us/requests/new.
Starting May 15, 2026, Google will begin the Google Switch (i.e., switching customer domains to the new permission model and discontinuing Negative ACLs). The operation will be rolled out over several days, so your domain may not be switched on May 15 itself but in the days that follow. At the latest, by the time of the Google Switch, AODocs will apply the following changes on its side:
- Team Folders libraries: permission management options will disappear from the AODocs user interface. It will no longer be possible to set document permissions from the AODocs user interface in Team Folders libraries.
- Secured Folders libraries only inheriting permissions from the Google Drive folder structure: the “ignore inherited permissions” flag in AODocs will adopt the same behavior as the “Limited Access” flag in Google Drive. It will no longer be possible to set this flag on individual documents.
- For Secured Folders libraries inheriting permissions from workflow state or document class: AODocs will make the library's folder structure private, i.e., the AODocs folders will no longer be visible in Google Drive.
After the Google Switch, new behavior will be live in your AODocs libraries as described in sections 3 and 4.
- For Team Folders libraries: you will no longer be able to set document permissions from the AODocs user interface.
- For Secured Folders libraries only inheriting permissions from the Google Drive folder structure: you will no longer be able to inherit permissions from classes or workflows.
- For Secured Folders libraries inheriting permissions from workflow state or document class: the permission logic will remain unchanged (although the folder structure will not be visible on Google Drive).

We are continuing to press Google for a longer delay with respect to the Google Switch, and we will communicate any new date granted by Google promptly, if any.

6. Summary table

If you have…	Default solution	What changes for you	On-demand alternative (support ticket required before May 7, 2026)
Team Folders	Stay on Team Folders; Google applies “Limited Access” flags on relevant Google Drive folders and files (Google Conversion)	No more permission changes from the AODocs interface (permissions managed in Google Drive only); Class- and workflow-based permissions no longer enforced; No longer possible to detach document-level permissions in AODocs (i.e., to “block” the inheritance of permissions on a single document); Once the “Limited Access” flag applied by the Google Conversion is removed from a file, it cannot be reapplied	Convert to Secured Folders (with private visibility)
Secured Folders - only Google Drive folder-level permissions	Stay on Secured Folders (public visibility); Google applies “Limited Access” flags on relevant Google Drive folders and files (Google Conversion)	The “ignore inherited permissions” flag in AODocs will adopt the same behavior as the “Limited Access” flag in Google Drive; No longer possible to configure the document permissions to be inherited from the AODocs document’s class or the AODocs document’s workflow state; No longer possible to detach document-level permissions in AODocs (i.e., to “block” the inheritance of permissions on a single document); Once the “Limited Access” flag applied by the Google Conversion is removed from a file, it cannot be reapplied	Convert to Secured Folders (with private visibility)
Secured Folders - AODocs class- or workflow-based permissions	Switch to Secured Folders (with private visibility)	Folder structure no longer visible in Google Drive (still visible in AODocs); Permission logic unchanged	Stay on Secured Folder (public visibility), accepting that class/workflow permissions will no longer be enforceable
DMS	No change expected

7. Questions or concerns

We understand this is a lot to absorb. If you have any questions, please do not hesitate to reach out to your AODocs account manager or to contact AODocs support (https://support.aodocs.com/hc/en-us/requests/new).

A note from us

We want to be straightforward about this: we did not choose this change. At the same time, we have used the past several months to work hand-in-hand with Google, to test our response on our own internal domains first, and to design a solution path that preserves your permissions and gives you meaningful choices wherever we can. Our goal has been and remains that you experience as little disruption as possible, and that you end this transition with a platform that is simpler and as secure as the one you have today.