Group Management

Group membership from rules, not hand-editing.

Write the rule once, preview exactly who matches, and let every add and remove wait for an admin's approval before it reaches Google.

What it does

Group Management turns directory data into group membership. You build a rule from twelve directory fields: Department, Job Title, Cost Center, Organization Name, Organization Description, City/Locality, State/Region, Postal Code, Country, Manager Email (direct), Manager Email (indirect, up the reporting chain) and Email. Eight operators apply to each field, including Equals, Not Equals, Contains, Not Contains, Starts With, Ends With, Is Empty and Is Not Empty, and conditions combine with AND, OR and NOT groups nested as deep as you need. Before you save, the Preview Members modal lists who the rule would match today, with the full count alongside the first two hundred rows, and suspended users can be kept out of the preview. Saving stores the rule as a new version, so an audit trail of who changed what exists even though versions are not yet browsable.

Who it's for

Workspace admins who maintain distribution lists and access groups by hand every time someone joins, leaves or moves team. Organizations where group membership gates Drive access, mailing lists or applications, and where an accidental mass edit is worse than the manual work it replaces.

How it works

1. Build the rule. Pick fields, operators and values, and combine them with AND, OR and NOT. The builder warns about patterns that can match too broadly.
2. Preview and save. Preview Members shows the matching users before anything is stored. Save writes the next rule version.
3. Run a sync. A sync evaluates the rule against your directory. On a connected Workspace it does not write to Google: each add and remove is recorded as a proposal in the Approval Gate, with the rule version as its rationale.
4. Approve. Any Geeplo admin approves the proposal. The change is then applied by the gated executor and recorded in the admin log.
5. The safety stop. A sync that would remove more than half of a group's rule-added members, in a group with more than ten rule-added members, aborts before touching Google and reports the reason.

What it doesn't do (yet)

Rules cannot read last-login dates or custom schema fields. Rule versions are stored but not displayed, and there is no rollback screen. Members added by hand are never removed by a rule; the sync counts them as skipped. Alias handling splits: an alias on a restricted name waits in Requests for an admin, while any other alias is created in Google straight away. Syncs do not run on a schedule by themselves; an owner starts each one. Group changes are recorded in the Geeplo admin log, and the log covers what Geeplo did, not a history of edits made directly in Google.

What access it needs

Reading groups for rules uses the Cloud Identity groups read-only scope. Writes ride the Approval Gate's executor scopes, which are the Directory group and group member scopes plus Drive, and are listed on the scopes page.

Related modules

Approval Gate (where the proposals land), Teams (link a group to an accountable team), Requests (where restricted aliases wait). The Approval Gate, Teams and Requests pages are not up yet.