Why Drive's AI Can Propose a Change to Your Document but Never Apply It Alone
Drive's AI can read, summarize, and propose edits to your documents — but the tools that would let it delete, bulk-modify, or share something outward simply don't exist. Here's the actual mechanism, not a policy statement.
"Can the AI silently change or delete my data" is the single most common blocker enterprise buyers name when evaluating AI-native tools right now, and most products answer it with a policy statement — a paragraph in a trust page saying the AI respects your permissions, reviewed by a human somewhere. That's reassuring in the way any promise is reassuring, which is to say: only as far as you trust the promise. Piskes Drive's answer is different in kind. It's not a policy. It's a description of what tools exist.
The three tiers, and what's actually true of each
Drive's AI operates under a permission model implemented directly in frontend/apps/drive/src/lib/drive/proposals.ts, and the file's own description of it is unusually direct: "No agent writes a document. A write tool records what it would do and stops; a person applies it." That sentence is the whole architecture, stated plainly.
Reading is free. The AI can read a document and summarize it without asking permission for each read — there's no friction here because there's no risk here. Read access doesn't change anything.
Editing and creating require a proposal. When you ask the AI to change something in an existing document, it doesn't change it. It writes a proposal — a record of what it would do — and stops. A person looks at that proposal and clicks to apply it, or doesn't. The distinction from "the AI made a suggestion in a chat window" is that applying a proposal goes through Drive's ordinary save path, which means it's undoable through the exact same version history as any change you made by hand yourself. There's no special, harder-to-reverse category for AI-originated edits.
Delete, bulk-delete, and outward sharing are blocked at the tool level. This is the part worth sitting with, because it's a categorically stronger claim than "the AI is instructed not to delete things" or "deletion requires confirmation." There is no tool available to the AI that performs a delete, a bulk-delete, or an outward share. Not a tool that's gated behind a permission check that could theoretically be misconfigured or bypassed by a clever enough prompt — a tool that doesn't exist in the set of things the AI can invoke at all. You cannot misconfigure your way into an AI that deletes your files, because deleting isn't one of the actions it has the capability to take, under any configuration.
Why the distinction between "won't" and "can't" actually matters
A policy that says an AI won't do something is a statement about intended behavior, and intended behavior is exactly what breaks under an unusual prompt, an edge case nobody anticipated, or a bug in the layer that's supposed to enforce the policy. A tool that doesn't exist can't be talked into running regardless of what anyone types into a chat box. That's a stronger property, and it's the one Drive actually has.
What this changes about how you can use it
Because applying a proposal is just an ordinary edit going through the ordinary save path, you don't need a separate mental model for "AI changes" versus "changes I made" — they're both just edits with a version history behind them, one of which happened to be drafted by AI first and approved by a person second. That's the actual shape of the trust story here: not "trust the AI," but "the things that could go wrong don't have a path to happen," which is a claim you can verify against the code rather than one you have to take on faith.