Which Drive sharing settings does Applane need?

Who

Google Workspace admin

Time

5 minutes, often nothing to change

Applane does not change Apps > Google Workspace > Drive and Docs > Sharing settings. Your Workspace policy still determines which sharing actions Google allows.

Each app has one audience, chosen when it is created and fixed after that.

Audience	Who can open the app	What your Drive policy must allow
Internal (default)	Anyone signed in at your domain	Nothing extra. Google rejects any non-domain login before the app’s code runs.
External	Named external accounts outside your domain	External sharing on for the builders’ OU, or those accounts’ domains allowlisted. The app is published from the bot account.
Public (anonymous link)	Anyone with the link, no sign-in	“Anyone with the link” sharing allowed for the publishing OU. The app may only show data that is already public.

If external sharing is off for the builders’ OU, Google can refuse the related sharing or publishing actions. Disable those audiences in Applane settings to make the restriction clear to builders. That is a valid configuration; many companies run internal-only.

Source collaboration is a Drive ACL

An app’s source is an Apps Script project, which is a Drive file. Who can edit that file is a Drive permission, set through Google’s own share dialog. The builder’s Share button opens that dialog; it never grants access itself.

So whether a builder can add an external account as an editor of an app’s source is decided entirely by your Drive external-sharing policy. Applane neither enables nor restricts it.

What to set

• Internal-only company: leave your policy as it is. Confirm the audiences are limited to internal in the Applane console Settings.
• External apps: allow external sharing for the OU that holds applane-bot@ and the builders, or allowlist the external users’ domains. Keep “warn on external sharing” on if you have it.
• Public apps: allow link sharing for the bot’s OU. Review the public-data-only rule with the builders.