GTRADE-007: Admin Role Granted Through a Group
- Platform
- Google Workspace
- Category
- Adversary Tradecraft
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 4
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- original
What it checks
Google Workspace lets an admin role be assigned to a security group instead of a user; every member — direct or nested through a child group — inherits the role's privileges, and anyone who can edit the group's membership can grant themselves the role. A broad-privilege role on a group is therefore a membership-based escalation path: the group's edit-membership control becomes the effective grant of the role. This is the Workspace analogue of an Active Directory nested-group-to-privileged-group path. This check enumerates every role assigned to a group, resolves the group's members (including nested subgroups), and flags the escalation surface; whether each grant is intended is the district's determination, so broad-privilege grants FAIL and narrow ones WARN for review.
Recommended value
Admin roles are assigned to named individuals, not groups; where a group grant is deliberate, its membership is tightly controlled and the role is least-privilege
Remediation
Admin Console > Account > Admin roles > (role) > Admins. For each role assigned to a group, confirm the group grant is intended; prefer assigning privileged roles to named individuals. Where a group grant stays, restrict who can edit the group's membership (owners/managers), remove nested subgroups that widen the reach, and reduce the role to least privilege. Review who can add members to the group and any nested child groups.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| nested | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, AC-2, AC-5
- MITRE ATT&CK
- T1078.004, T1098