Question

A financial services company operating under strict regulatory requirements must ensure that no Google support or engineering personnel can access their customer data unless the company's own security team has explicitly granted permission for each access request. They already have Access Transparency logs enabled but want to move from passive visibility to active pre-authorization. Which capability should they configure to meet this requirement?

Accepted Answer

Enable Access Approval so that a designated approver in the organization must grant explicit consent before Google personnel can access covered resources

Answer

Configure Key Access Justifications with a policy that automatically denies all unjustified key access requests

Answer

Enable Data Access audit logs for all services so that every read of customer data is recorded for review

Answer

Deploy an Assured Workloads folder to restrict Google support personnel to in-region staff only