GWS-K12-004: Vendor Delegated Access Review
- Platform
- Google Workspace
- Category
- K12 Baseline
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- original
- Scope
- Tenant-wide: assessed across the whole tenant, no student OU input required.
Guerrilla K12 Baseline (candidate)
This check assesses control K12-IDENT-002 of the K12 Secure Configuration Baseline, version 0.1.0, a candidate community baseline authored by Guerrilla. It is openly published and open for comment; it is not a consensus standard, and this block is deliberately separate from the external framework mappings below.
What it checks
Domain-wide delegation grants give a vendor's service account standing access to user data across the tenant, including student data. SIS platforms, rostering tools, and EdTech vendors accumulate these grants over years and stale grants rarely get removed. Every grant with sensitive scopes should map to a current vendor contract and the narrowest workable scope set.
Recommended value
Every domain-wide delegation grant maps to a current vendor and carries only the scopes that vendor needs
Remediation
Admin Console > Security > Access and data control > API controls > Domain-wide delegation. For each client ID, confirm which vendor owns it and that the contract is current; remove grants for departed vendors; reduce scope sets that exceed the vendor's function (mail, Drive, directory, and contacts scopes deserve particular scrutiny).
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| not-assessed | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, AC-20
- MITRE ATT&CK
- T1098.001, T1550