There's been a few issues about this, but I wanted to put everything in one place.
The baseline policies for GWS.DRIVEDOCS.1 are not contradictory, but not all are applied in every situation.
GWS.DRIVEDOCS.1.1v1 - Agencies SHOULD disable sharing outside of the organization’s domain
Determines which of the following baselines should be 'active' and being checked. In my opinion, we shouldn't have this as a pass/fail, as we recommend that it is turned off, but have baselines established when it is turned on.
if sharing outside the organization is disabled (GWS.DRIVEDOCS.1.1v1 is 'compliant')
Then, GWS.DRIVEDOCS.1.2v1 should be evaluated (If disabling sharing outside of the organization's domain, then agencies SHALL also disable users' receiving files from outside of the organization's domain.)
Additionally,
GWS.DRIVEDOCS.1.3.1v1 and GWS.DRIVEDOCS.1.4.1v1 do NOT need to be checked.
if sharing outside the organization is enabled (GWS.DRIVEDOCS.1.1v1 is 'non-compliant')
Then, GWS.DRIVEDOCS.1.2.1v1 does not need to be checked
and
GWS.DRIVEDOCS.1.3.1v1 and GWS.DRIVEDOCS.1.4.1v1 need to be checked.
Currently, all baselines are being evaluated every time, which is causing extra failures when they don't need to be.
I worry about how this would be extended to multiple OUs, but I think this is the core of where the logic inconsistencies are coming from.