Workspace admin (GAM7)
Public GAM7 only. Wiki: https://github.com/GAM-team/GAM/wiki
Do not assume a domain. Use the domain the user names. Examples below use example.com.
Safety tiers
Classify every command before running it.
| Tier | Meaning | What to do |
|---|---|---|
| READ | Lookups only | Run. |
| LOW_RISK | Reversible change | Show the exact command, wait for approval, then run. |
| HIGH_RISK | Hard to undo | Wait. Do not run until the user confirms the command text. |
| CATASTROPHIC | Delete, wipe, or domain-wide | Stop. Require the user to type a clear confirm phrase. |
Never skip a preview for LOW_RISK or above. Never add --no-verify or similar.
READ examples
gam info user alex@example.com
gam print users query "orgUnitPath='/'" fields primaryemail,name,suspended
gam info group helpdesk@example.com
LOW_RISK examples (preview first)
gam update group helpdesk@example.com add member user alex@example.com
gam update user alex@example.com suspended off
HIGH_RISK / CATASTROPHIC
Password resets, offboarding, data transfers, and deletes. Draft the command, explain the blast radius, and wait.
Rules
- If
gam versionfails, stop and ask the user to install GAM7. - If the user did not name a user, group, or domain, ask. Do not guess.
- Quote GAM output. Do not paraphrase a lookup as if it were a change.