--- title: GAT Unlock Overview description: "# What is GAT Unlock? [https://www.youtube.com/embed/dHnFb63Kk8k?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1](https://www.youtube.com/embed/dHnFb63Kk8k?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1) GAT Unlock is a **Multi-Party Approval system** that works alongside GAT+ to allow Google Workspace Admins to perform sensitive actions securely and with full accountability. It is designed to prevent a single admin from…" url: "https://gatlabs.com/knowledge/tech-tips/unlock-overview/" updated: "2025-12-16" category: Products Overview tags: - GAT Unlock --- # GAT Unlock Overview # What is GAT Unlock? [https://www.youtube.com/embed/dHnFb63Kk8k?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1](https://www.youtube.com/embed/dHnFb63Kk8k?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1) GAT Unlock is a **Multi-Party Approval system** that works alongside GAT+ to allow Google Workspace Admins to perform sensitive actions securely and with full accountability. It is designed to prevent a single admin from accessing files, emails, or changing document ownership without oversight. Any action that affects user data requires active approval from a second authorised person within the organisation, typically a Security Officer. This ensures sensitive access is controlled, auditable, and transparent. The second person is the “[Security Officer](https://gatlabs.com/knowledge/tech-tips/what-is-a-security-officer/)” and is responsible for approving or denying requests submitted by the Super Admin. The Security Officer can be any member of the domain. For easier management, it is recommended to have **at least two Security Officers** in the domain. GAT Unlock can be used to: - [**Allow setting up Email delegation within GAT+**](https://gatlabs.com/knowledge/tech-tips/easily-delegate-one-gmail-account-to-another-indefinitely-or-temporary/) - **Allow setting Email auto-forwarding within GAT+** - [**Allow change of ownership of Drive files within GAT+**](https://gatlabs.com/knowledge/tech-tips/change-ownership-of-a-google-drive-file/) - **Allow altering Drive files by adding and replacing existing permissions** - [**Allow copying Drive files **](https://gatlabs.com/knowledge/tech-tips/google-drive-externally-owned-files-copy/) - [**Allow viewing File content**](https://gatlabs.com/knowledge/tech-tips/silently-view-files-from-your-users-google-drives/) - [**Allow download of the File content**](https://gatlabs.com/knowledge/tech-tips/silently-view-files-from-your-users-google-drives/https://gatlabs.com/knowledge/tech-tips/silently-view-files-from-your-users-google-drives/) - [**Allow viewing Email content**](https://gatlabs.com/knowledge/tech-tips/view-or-download-email-contents/) - [**Allow download of Email content **](https://gatlabs.com/knowledge/tech-tips/view-or-download-email-contents/) - [**Allow Admins to onboard offboard and modify users within Flow**](https://gatlabs.com/knowledge/tech-tips/automate-user-onboarding-using-gat-flow/) **Prerequisite:**When ‘GAT Unlock’ is enabled, Admins can generate access or change requests, but only Security Officers can approve them. An individual can be a member of both lists, but cannot approve their own requests. The Security Officer list for all domains is maintained by the GAT Labs staff. **Availability:** Unlock is part of **all** plans for **Education** domains: - [Lite Plan](https://gatlabs.com/education/pricing/) - [Manage Plan](https://gatlabs.com/education/pricing/) - [Vigilant Plan](https://gatlabs.com/education/pricing/) For **Enterprise,** Unlock is part of: - [Admin Plan](https://gatlabs.com/pricing/) - [Secure Plan](https://gatlabs.com/pricing/) ## **GAT Unlock Features** ### **Drive Audit** Within the GAT+ auditing areas, you’ll find GAT Unlock related features like: - **File Management** – Using this action you can change ownership of the files or folders you select. You can also add new contributors/viewers or commenters to any file or folder you’ve selected. - Use Case Examples: - [File management – Options when changing Ownership of a file in Google Drive](https://gatlabs.com/knowledge/tech-tips/options-when-changing-ownership-of-a-file-in-google-drive/) - [Search for Specific File Types & Change Ownership in Google workspace](https://gatlabs.com/knowledge/tech-tips/search-for-specific-file-types-change-ownership-in-google-workspace/) - [Replace the current sharing permissions on your Google Drive files](https://gatlabs.com/knowledge/tech-tips/replace-the-current-sharing-permissions-on-your-google-drive-files/) - **Select file copy ** – You can create a duplicate copy of any file or folder you’ve selected. - Use Case Examples: - [Copy Externally Owned Folders and its Content to Your Google Drive (while retaining folders’ structure)](https://gatlabs.com/knowledge/tech-tips/copy-externally-owned-folders-and-its-content-to-your-google-drive-while-retaining-folders-structure/) - [Copy Files and Folders from Internal and External Users in Bulk](https://gatlabs.com/knowledge/tech-tips/copy-files-or-folders-from-internal-or-external-users/) - **Create a new access request** – You can gain access to the contents of a file. With GAT+ only (without this feature), you can only view metadata related to the file. With GAT Unlock’s access request feature, you can gain access to the actual contents of files. - Use Case Examples: - [Request View of Content of a File in Google Drive](https://gatlabs.com/knowledge/tech-tips/view-content-of-google-drive-files/) ### **Shared Drive audit** You'll find the GAT Unlock functionality in the Shared Drive tab of the GAT+ Drive auditing area. - Alter the membership settings of a Shared Drive: - [Adding – Shared drive permissions](https://gatlabs.com/knowledge/tech-tips/shared-drive-membership-management/#3-toc-title) - [Removing – Shared drive permissions](https://gatlabs.com/knowledge/tech-tips/shared-drive-membership-management/#4-toc-title) - [Replacing – Shared drive permissions](https://gatlabs.com/knowledge/tech-tips/google-drive-shared-drives-management/#4-toc-title) - Use Case examples: - [Shared Drives management](https://gatlabs.com/knowledge/tech-tips/google-drive-shared-drives-management/) - ### **Email audit** In the Email audit area, within the **Emails tab** and the** [Email Content Search](https://gatlabs.com/knowledge/tech-tips/find-and-delete-phishing-emails/) **tab, you’ll find the following GAT Unlock feature: [**Create a new access request** ](https://gatlabs.com/knowledge/tech-tips/view-or-download-email-contents/#5-toc-title)– With this feature, you can gain access to email content. Without this feature, you can only see metadata related to emails but not the actual contents. While using this feature you can enable some additional requests: - [Download emails (EML, PDF)](https://gatlabs.com/knowledge/tech-tips/view-or-download-email-contents/#9-toc-title) - [Remove emails (permanent, trash only)](https://gatlabs.com/knowledge/tech-tips/view-or-download-email-contents/#11-toc-title) ##### Create Access Request Use Case Examples: - - [View or Download Email Contents](https://gatlabs.com/knowledge/tech-tips/view-or-download-email-contents/) ##### Download Email Use Case Examples: - - [Delete Spam, Inappropriate or Accidental Emails](https://gatlabs.com/knowledge/tech-tips/delete-spam-inappropriate-or-accidental-emails/) ### **Users – Email delegation** In the User audit area (within the Email Info tab) you’ll be able to set Gmail mail delegation or an email auto-forwarding policy for any user. This is an actionable feature of GAT Unlock. #### Set up Email Delegation use case example: - - [Delegate a User to Access Another User’s Gmail Account](https://gatlabs.com/knowledge/tech-tips/easily-delegate-one-gmail-account-to-another-indefinitely-or-temporary/) ### **Pre-Approve Access to Files or Emails and Flow:** ‘Pre-approval is the ability to set up a Workspace Super Admin to use the GAT Unlock functionality without needing approval from the Security Officer for each request. Pre-approval policies can be created by the Security Officers only. It is a one-time setup. #### Pre-Approval by Security Officer Use Case Examples - - [Preapproval access for Unlock (Email and Drive)](https://gatlabs.com/knowledge/tech-tips/how-to-set-up-preapproval-access-for-unlock/) - [How to set up preapproval access for Flow](https://gatlabs.com/knowledge/tech-tips/how-to-set-up-preapproval-acces-for-flow/) ## **GAT Flow ** **GAT Unlock is a prerequisite for Flow to work.** For every request in GAT Flow, approval from a Security officer is required, unless pre-approval is set up. --- #### **5 most useful things with Unlock** 1. [How to Use Unlock](https://gatlabs.com/knowledge/tech-tips/gat-unlock-first-steps/) 2. [Search for Specific File Types & Change Ownership in Google Workspace](https://gatlabs.com/knowledge/tech-tips/search-for-specific-file-types-change-ownership-in-google-workspace/) 3. [Set up Email delegation](https://gatlabs.com/knowledge/tech-tips/easily-delegate-one-gmail-account-to-another-indefinitely-or-temporary/) 4. [View content of any Google Drive file](https://gatlabs.com/knowledge/tech-tips/view-content-of-google-drive-files/) 5. [View or Download Email Contents](https://gatlabs.com/knowledge/tech-tips/view-or-download-email-contents/)