Owner, organizer, writer: Drive's six roles, explained
The sharing dialog shows you three friendly words: Viewer, Commenter, Editor. Under the hood there are six roles, and the extra three are where audits get interesting.
When you read sharing data the way an audit does, through Drive's API rather than its dialogs, every grant carries one of six role names. Here they are, from most to least privileged, with the UI name Google shows for each.
| API role | In the UI | What it can do |
|---|---|---|
owner |
Owner | Everything, including deleting the file and transferring ownership. It only exists on My Drive items; shared-drive files have no individual owner. |
organizer |
Manager | A shared-drive role: manages the drive itself (members, settings, moving content out, deleting the drive) plus everything below. |
fileOrganizer |
Content manager | Also shared-drive only: can edit, move, and trash content within the drive, but can't touch membership or settings. |
writer |
Editor | Edit content and, a detail people forget, share the file onward with others unless the owner has disabled it. |
commenter |
Commenter | Read and comment. Can't edit, can't share onward. |
reader |
Viewer | Read only. This is also the role behind most "anyone with the link" shares. |
The two that surprise people
organizer and fileOrganizer never appear
on your personal files. If one shows up in an audit, the file lives
in a shared drive, and that person's access comes from drive membership,
not from any per-file share. That changes the cleanup: deleting a file
permission won't help, because there's nothing on the file to delete. The
fix is removing or downgrading their membership in the shared drive itself.
writer is more powerful than "Editor" sounds.
By default an editor can re-share the file, which means the audience of a
file is bigger than the list you see: it includes anyone the people on
that list choose to add. If you're granting access for a one-off edit, Commenter plus
"suggesting" mode often covers it with far less surface area.
Why the role is only half the story
Two grants with the same role can mean very different things. A
reader grant made directly on a file survives un-sharing its
parent folder; the same grant inherited from the folder disappears with it.
An audit that shows only roles tells you who can act. One that also shows
where each grant lives tells you what will actually happen when
you start revoking.
That's the model Drive Auditor reports in: person by person, role by role, with each grant labeled inherited or direct from Drive's own permission details. Learn to read the six roles and an access report turns from a wall of names into an actual to-do list.