GWS Vault Rapid

Rapid command for Google Vault eDiscovery operations -- manage matters, legal holds, exports, and saved queries for compliance and litigation support.

When to Use This Command

Run this command when you need to perform eDiscovery operations through Google Vault for legal, compliance, or audit purposes.

• You need to create a new matter for a legal case or internal investigation
• You want to place legal holds on custodian accounts to preserve data
• You are exporting data from a matter for legal review or compliance reporting
• You need to manage matter permissions, adding or removing collaborators

Use it also when:

• You want to track long-running export operations with operations get
• You need to undelete or reopen a previously closed or deleted matter

Quick Start

Copy
# .claude/commands/gws-vault-rapid.md
name: gws-vault-rapid
description: Rapid Google Vault eDiscovery operations
arguments:
  operation: The Vault operation to execute

Copy
# List all open matters
claude gws-vault-rapid "matters list --params '{\"state\": \"OPEN\"}'"

Expected output:
{
  "matters": [
    {
      "matterId": "m_abc123",
      "name": "Investigation Q1-2026",
      "state": "OPEN",
      "description": "Internal compliance review"
    }
  ]
}

Core Concepts

Concept	Description
Matter	A container for an investigation, case, or compliance project
Hold	A legal hold preserving data for specified accounts or OUs
Export	A data extraction from a matter for external review
Saved Query	A reusable search query within a matter
Operation	A long-running async process (e.g., data export)

Vault Workflow:
  Create Matter ──> Define Scope ──> Place Holds
                                         │
       Download <── Export Data <── Run Queries
                                         │
                                    Close Matter ──> Archive

Configuration

Parameter	Default	Description
matterId	required	The unique matter identifier for most operations
state	OPEN	Filter matters by state: OPEN, CLOSED, DELETED
format	json	Output format: json, table, yaml, csv
page-all	false	Auto-paginate through matter listings
dry-run	false	Validate without executing

Best Practices

1. Create descriptive matter names -- Include case numbers, dates, or investigation codes in matter names for easy identification across your organization.

2. Use count before export -- Run matters count to estimate the volume of data before initiating a full export, helping plan storage and processing resources.

3. Track export operations -- Exports are asynchronous. Use operations get to poll the export status and operations list to monitor all running exports.

4. Manage matter permissions carefully -- Use addPermissions and removePermissions to control who can access sensitive investigation data.

5. Close matters when complete -- Use matters close to prevent further modifications while preserving all data. Closed matters can be reopened if needed.

Common Issues

1. Cannot modify a closed matter -- Closed matters are read-only. Use matters reopen to restore the matter to an open state before making changes.

2. Export operation stuck in processing -- Long-running exports may appear stuck. Use operations get to check actual progress. Very large exports can take hours.

3. Insufficient Vault license -- Google Vault requires specific licensing (Workspace Business Plus, Enterprise, or Vault add-on). Users without the proper license will see permission errors when attempting to create matters or place holds.

Data Retention and Compliance

Google Vault is a compliance tool, so understanding retention policies is critical when using this command. Legal holds override any retention rules, preserving all data for held accounts regardless of deletion or retention expiration. When creating holds, specify the scope carefully: you can hold by individual accounts, organizational units, or specific search queries. The exports sub-resource creates a point-in-time snapshot for legal review, and export files are stored temporarily in Google Cloud Storage. Download exports promptly, as they are automatically deleted after 15 days. For large-scale investigations spanning thousands of accounts, use the count method first to estimate data volume and plan your export strategy accordingly. All Vault operations are logged in the Admin Audit log for organizational compliance tracking.