How to Set Up Content Compliance Rules in Google Workspace

A misconfigured Google Workspace content compliance rule can silently quarantine every email your team sends for days before anyone notices the problem. The configuration screen looks approachable, but the three actions a rule can take — modify, quarantine, and reject — behave completely differently in production. Quarantine holds messages for review with no sender notification; reject returns a bounce immediately and permanently; modify delivers the message after altering it. Getting that choice wrong, or applying a rule to the wrong organisational unit, is where most accidental outages start.

This guide covers building a google workspace content compliance rule for inbound, outbound, and internal mail, with worked examples for flagging sensitive data and blocking risky attachments. If you have ever wondered why your rule fires in the Admin Console test tool but not in live traffic, or how content compliance differs from the objectionable content and attachment compliance rule types, the answers are below.

The short answer#

Open Admin Console at admin.google.com, navigate to Apps > Google Workspace > Gmail > Compliance, scroll to Content compliance, and click Add another rule (or Configure if no rules exist yet). Name the rule, select the message directions it covers, add at least one expression to match against, choose an action, and save. The rule becomes active immediately for the chosen scope.

The hard part is not the navigation — it is configuring the expression correctly and selecting the right action for your situation. The rest of this guide walks through each decision in order, with the mistakes that cause the most real-world disruption called out before the steps.

Before you start#

You need a Super Admin account, or a delegated admin role that explicitly includes the Gmail — Compliance privilege. Standard admin roles do not grant access to the compliance settings by default.

Before writing a rule, make two decisions. First, what action do you want when the rule fires? If you want to review messages before they are delivered or discarded, you need a named quarantine. Create one first under Apps > Google Workspace > Gmail > Setup > Quarantine, assign at least one reviewer, and give it a descriptive name — you cannot select a quarantine in a rule that does not yet exist. Second, what is the scope? A rule applied at the top-level domain applies to every user in your organisation. A rule scoped to a specific organisational unit applies only to users in that OU. Scope is controlled by the account selector in Admin Console before you open Gmail > Compliance, not inside the rule editor itself.

• Super Admin or delegated Gmail — Compliance privilege required before any step below
• Named quarantine must exist before you can choose it as the rule action
• Scope the Admin Console view to the right OU before navigating to Compliance — the rule inherits the scope you are viewing
• Regex expressions use RE2 syntax, not PCRE — patterns with lookaheads or backreferences will not work
• Rules propagate to the built-in test tool immediately, but can take up to 24 hours to reach live traffic in large domains

How to create a content compliance rule#

1. 1

   Open the compliance settings

   Sign in to Admin Console (admin.google.com) as a Super Admin or a delegated admin with the Gmail — Compliance privilege. Navigate to Apps > Google Workspace > Gmail > Compliance. Scroll past the spam, routing, and safety sections until you reach the Content compliance block.

2. 2

   Add a new rule

   If no rules exist yet, click Configure. If rules already exist, you see a table with an Add another rule link at the bottom. Click either to open the rule editor.

3. 3

   Name the rule

   Use a name that includes the scope, the data being matched, and the action — for example: Outbound SSN quarantine or Inbound exe attachment reject. Rule names appear in Email Log Search delivery logs and in the compliance audit trail. A clear name means the difference between a five-second diagnosis and a thirty-minute investigation.

4. 4

   Select the affected message directions

   Check every direction the rule should cover: Inbound (from outside your domain to your users), Outbound (from your users to outside your domain), Internal - sending (the sender is in your domain), Internal - receiving (the recipient is in your domain). A data-loss rule targeting outbound PII should check Outbound only. A rule quarantining attachments from external senders should check Inbound only. Checking all four on a broad-match rule is a common cause of unexpected bounces for internal messages.

5. 5

   Add at least one expression

   Click Add under Expressions and choose the expression type. Simple content match targets a keyword or phrase in the message, case-sensitive or not. Advanced content match lets you specify a particular message part: subject, body, sender header, attachment filename, or attachment content. Metadata match targets message attributes like authenticated sender, TLS enforcement status, IP address range, or message size. Predefined content match uses Google's built-in detectors for credit card numbers, US Social Security Numbers, passport numbers, IBAN codes, and around twenty other sensitive data types. For a Social Security Number rule, choose Predefined content match > US — Social Security Number, set sensitivity to Low or Medium, and set the minimum match count to 1.

6. 6

   Choose the action

   Under 'If the above expressions match, do the following', select one action: Modify message, Quarantine message, or Reject message. Modify delivers the message after altering it — options include adding a custom header, prepending a subject tag, redirecting a BCC copy to a compliance archive address, or removing attachments. Quarantine pauses delivery and routes the message to the named quarantine inbox; the original sender receives no notification. Reject refuses delivery immediately and sends the sender a non-delivery report containing the custom rejection text you write here.

7. 7

   Write a clear rejection notice if rejecting

   When the action is Reject, write a specific rejection message. The sender sees this text in their bounce notification. A message like 'Message rejected: outbound attachment type not permitted by company policy. Contact IT at [email protected] for exceptions.' reduces repeat attempts and support tickets far more than generic boilerplate.

8. 8

   Save and verify

   Click Save. Test immediately: click the rule name, then Test this rule, paste a sample message body that should trigger the rule, and confirm the result shows the expected action. Then send a real test message through the affected direction and open Email Log Search (Apps > Google Workspace > Gmail > Email Log Search) to confirm the rule name appears in the delivery log with the correct action taken.

Content compliance vs objectionable content vs attachment compliance#

Google Workspace offers three distinct rule types under Gmail > Compliance. They are not interchangeable, and choosing the wrong type limits what you can match and which actions are available. The table below summarises the practical differences across the four rule types admins commonly use.

What to do when the rule does not trigger#

A rule that fires in the Admin Console test tool but not in live traffic is almost always a scope, direction, or propagation problem. A rule that never fires in the test tool has an expression error. Work through the following causes before editing the rule itself — editing during propagation creates overlapping versions that are harder to debug.

Wrong message direction is the most common mistake. A rule set to Outbound only will not match mail between two users on the same domain. Internal - sending and Internal - receiving are separate checkboxes. If you need to catch user-to-user traffic within your domain, both Internal checkboxes must be selected.

RE2 syntax errors break regex silently. Google Workspace uses the RE2 regular expression engine, not the PCRE engine used by Python, JavaScript, and most online regex testers. Patterns containing lookaheads, lookbehinds, or backreferences will compile without error messages but will never match anything. Test your regex in an RE2-compatible tool before deploying.

Wrong OU scope is invisible inside the rule editor. If Admin Console was scoped to a child OU when you navigated to Gmail > Compliance, the rule applies only to that OU. The Applies to column in the rule list shows the scope. If it shows a child OU when you intended the whole domain, delete the rule and recreate it from the domain-level account selector.

Attachment content not indexed prevents predefined detectors from firing. Password-protected archives, encrypted PDFs, and most binary formats — images, compiled executables — are not scanned for content because Google cannot index them. Use an Attachment compliance rule by file type or name for those formats.

A faster way to triage what compliance rules miss#

Workspace compliance rules govern domain policy at the gateway. They handle what your organisation permits to enter or leave, but they do not help individual users manage what arrives in their inbox after the gateway pass — the cold outreach that slips past spam filters, the vendor threads that need a reply by end of day, the internal messages that need filing into the right project. Those decisions play out at the inbox level, and Admin Console has no lever for them.

We build AI Emaily, an AI-native email client that adds a rules and behaviour layer above the inbox. Where a Workspace compliance rule fires on a content pattern at the gateway, AI Emaily's Rules Brain acts on sender behaviour, conversation context, and conditions you set — automatically filing, labelling, or surfacing messages without needing Admin Console access. A 7-day free trial is available on Pro and Autopilot plans. The two layers are complementary: Workspace compliance for domain policy, AI Emaily for personal triage on whatever reaches the inbox.