# Which Drive sharing settings does Applane need?

> Internal apps need nothing. Partner and public apps need external or link sharing allowed for the builders' OU. Applane never changes the policy itself.

Source: https://docs.applane.dev/workspace-admins/drive-sharing/

**Who:** Google Workspace admin  
**Time:** 5 minutes, often nothing to change

Applane does not change **Apps > Google Workspace > Drive and Docs > Sharing settings**. It reads your policy and works within it.

Each app has one audience, chosen when it is created and fixed after that.

| Audience | Who can open the app | What your Drive policy must allow |
|---|---|---|
| Internal (default) | Anyone signed in at your domain | Nothing extra. Google rejects any non-domain login before the app's code runs. |
| External (partner portal) | Named partner accounts outside your domain | External sharing on for the builders' OU, or the partner domains allowlisted. The app is published from the bot account. |
| Anonymous (public link) | Anyone with the link, no sign-in | "Anyone with the link" sharing allowed for the publishing OU. The app may only show data that is already public. |

If external sharing is off for the builders' OU, the external and anonymous audiences stay disabled in the extension. That is a valid configuration; many companies run internal-only.

## Source collaboration is a Drive ACL

An app's source is an Apps Script project, which is a Drive file. Who can edit that file is a Drive permission, set through Google's own share dialog. The extension's Share button opens that dialog; it never grants access itself.

So whether a builder can add an external account as an editor of an app's source is decided entirely by your Drive external-sharing policy. Applane neither enables nor restricts it.

## What to set

- Internal-only company: leave your policy as it is. Confirm the audiences are limited to internal in the Applane console [Settings](https://docs.applane.dev/console/settings/).
- Partner portals: allow external sharing for the OU that holds `applane-bot@` and the builders, or allowlist the partner domains. Keep "warn on external sharing" on if you have it.
- Public apps: allow link sharing for the bot's OU. Review the [public-data-only rule](https://docs.applane.dev/builders/sharing/#anonymous-public-link) with the builders.