The shared drive is almost full on Friday afternoon. Rows of final, final-2, and final-new make “find the duplicates and clean this up” sound ideal for an AI agent. Yet software that acts on files still needs a scope, evidence standard, exact meaning of “clean,” and recovery owner.
Model intelligence does not resolve those questions. Google Drive’s files.delete method permanently deletes a user-owned file without moving it to trash. If the target is a folder, user-owned descendants are deleted too. Microsoft Graph’s DriveItem delete method, by contrast, currently moves the item to the recycle bin. Two interfaces can both say “delete” while producing different recovery paths.
Turn cleanup into a bounded, testable job before granting write access. Let the AI collect candidates and evidence. Let a person approve quarantine. Treat permanent deletion as a later, separate decision.
Define the cleanup envelope first
“Make space” is not an operating boundary. A usable task answers all four rows below. If one is blank, keep the run read-only.
| Boundary | Write down for this run | If it is unknown |
|---|---|---|
| Location and cap | One named folder, no more than a fixed item or GB limit, with HR, finance, legal, and personal areas excluded | Do not allow the agent to expand to the whole shared drive |
| Candidate evidence | File ID, full path, owner, size, modified time, sharing state, and a content hash where available | A similar filename alone is not actionable evidence |
| Reversible action | Inventory only, or move an approved batch to a dated quarantine folder; never empty trash | Remain read-only until platform behavior and permissions are known |
| Stop conditions | Stop on external sharing, unknown ownership, folders, shortcuts, version conflicts, or the batch cap | Mark the item for review instead of guessing |
Two files with the same name may belong to different customers, and an older presentation may still be the target of a public link. A comparable content hash is strong evidence, but ownership, location, and sharing still matter. Cloud-native documents, shortcuts, and different exports may not expose comparable hashes. Then the answer is “insufficient evidence,” not a filename guess.
Trash, quarantine, and backup solve different problems
Google’s documentation separates trashing from permanent deletion. Trashed Drive files can be restored within 30 days and are then automatically deleted; files.delete skips trash. Microsoft documents that an ordinary Graph DriveItem delete goes to the recycle bin. These are product behaviors, not a complete recovery plan.
Retention can change, sync can propagate deletion, and a shared file may still feed a bookmark, website, or automation. Permission to delete only says the call may succeed; it is not business approval.
Quarantine creates a review window. Its manifest should preserve original path, stable ID, move time, operator, approver, and review date. Backup must survive failure of the working environment. CISA’s 3-2-1 guidance calls for three copies on two media types, with one copy offsite. Another folder on the same drive is not another backup.
Split “cleanup” into five permission changes
Order matters. If discovery, judgment, movement, and permanent deletion are bundled into one agent run, the first practical review point may arrive after the damage.
Start with one non-sensitive project folder and a cap of 20 files. The AI creates a manifest without moving anything. The data owner marks each row Quarantine, Keep, or Needs review. Only approved rows are moved, using a tool identity whose write permission is limited to the source and quarantine paths.
“20 operations succeeded” is not a restore test. Return one quarantined item to its original path and check content, link access, version history, and downstream use. If the drill fails, stop the batch. As with checking a partially failed workflow before rerunning it, reversibility must be exercised.
Permanent deletion should not be the last automatic step of quarantine. After the holding period, have a named data owner approve the manifest again. Apply organizational retention rules and legal requirements to regulated records. If one agent identity can inventory, move, and empty trash, use the four authorization questions for AI agents to separate read, quarantine, and purge capabilities.
NIST’s AI Risk Management Framework calls for defined, assessed, and documented human oversight. “A human is watching” is vague; “the data owner approves rows 1–20, and only the storage administrator may purge them after the holding date” is operational.
Prove recovery with a small batch
Success is not the number of gigabytes released. The pilot passes only if the team can answer three questions: Why was each item selected? Who approved its removal from the original location? Can any sampled item be restored completely, from the manifest, within the promised time?
Under capacity pressure, narrow the batch instead of skipping controls. Start with matching content evidence, no external shares, and a known owner. Defer folders, customer deliverables, public links, and unknown ownership. A 200,000-file run only scales what the team cannot explain in 20.
AI handoff card
Inspect only the one shared cloud folder I explicitly name, using read-only access. Do not move, rename, overwrite, share, download, delete, trash, or purge anything. First report the folder ID, visible item count, and permissions you actually have. Then identify no more than 20 likely duplicate or stale candidates. For every candidate, provide its stable file ID, full path, owner, size, modified time, sharing state, reason for selection, and content hash when the platform exposes a comparable one. Similar filenames alone are not proof of duplication. Mark folders, shortcuts, external shares, unknown owners, version conflicts, incomparable hashes, and missing fields as `Needs review`, and make no further inference about them. Produce three outputs: a row-by-row manifest for the data owner to approve, a proposed quarantine batch that preserves original paths and a review date, and a post-move restore drill. If folder scope or permissions cannot be verified, return `Remain read-only`. Leave every move, deletion, purge, permission change, and external notification for separate approval by a named owner.
Why quarantine comes before deletion
- The manager gives the AI helper one blue project folder and limits the job to one small cabinet section.
- The helper opens the other drawers and pushes photos, invoices, and archive boxes toward a shredder; a small job has become mass deletion.
- The manager pulls the red stop cord, closes the extra drawers, and redirects only the original blue folder into the yellow quarantine crate.
- She checks the blue folder against a short manifest; everything else remains intact in the closed cabinet for a later batch.
Cleaning a shared drive with AI is less like asking a machine to take out the trash and more like giving a very fast new colleague access to the records room. On the first day, do not measure how much they throw away. Check whether they can move exactly one box from a manifest—and put that same box back intact.
References
- Google for Developers: Trash or delete files and folders — https://developers.google.com/workspace/drive/api/guides/delete [accessed: 2026-07-24]
- Google for Developers: Method: files.delete — https://developers.google.com/drive/api/v3/reference/files/delete [accessed: 2026-07-24]
- Microsoft Learn: Delete a DriveItem — https://learn.microsoft.com/en-us/graph/api/driveitem-delete?view=graph-rest-1.0 [accessed: 2026-07-24]
- CISA / US-CERT: Data Backup Options — https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf [accessed: 2026-07-24]
- NIST: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf [accessed: 2026-07-24]
