Google Workspace
Restrict how your agents can use Google Workspace.
Require agents to confirm every change, or let them forward mail only to the addresses you pick.
Google WorkspaceMail setup agent · acme.comkc_…w5p2
| Permission | Access | Mailboxes | Only when |
|---|---|---|---|
Domain aliases · Create domainAliases.create | Allowed | Whole Workspace | body.domainAliasName = northpier.io |
Domain verification · Verify verification.verify | Ask meWaits up to 24 hours | Whole Workspace | Any request |
Forwarding addresses · Create forwarding.create | Allowed | [email protected] | Recipient is one of [email protected] |
Forwarding addresses · Create forwarding.create | Ask meWaits up to 24 hours | All mailboxes | Any request |
Auto-forwarding · Change autoForwarding.update | Allowed | [email protected] | Recipient is one of [email protected] |
Send-as addresses · Create sendAs.create | Ask meWaits up to 24 hours | [email protected] | Any request |
Allowed goes straight throughAsk me waits for your confirmation
What you can control
Permissions
Each row of a key's Google Workspace access is one of these, set to Allowed or Ask me.
| Permission | Name in the API |
|---|---|
| Domains · Read | domains.read |
| Domains · Create | domains.create |
| Domains · Delete | domains.delete |
| Domain aliases · Read | domainAliases.read |
| Domain aliases · Create | domainAliases.create |
| Domain aliases · Delete | domainAliases.delete |
| Users · Read | users.read |
| Domain verification · Get token | verification.token |
| Domain verification · Verify | verification.verify |
| Domain verification · Read | verification.read |
| Domain verification · Delete | verification.delete |
| User aliases · Read | userAliases.read |
| User aliases · Create | userAliases.create |
| User aliases · Delete | userAliases.delete |
| Send-as addresses · Read | sendAs.read |
| Send-as addresses · Create | sendAs.create |
| Send-as addresses · Change | sendAs.update |
| Send-as addresses · Verify | sendAs.verify |
| Send-as addresses · Delete | sendAs.delete |
| Forwarding addresses · Read | forwarding.read |
| Forwarding addresses · Create | forwarding.create |
| Forwarding addresses · Delete | forwarding.delete |
| Auto-forwarding · Read | autoForwarding.read |
| Auto-forwarding · Change | autoForwarding.update |
| Filters · Read | filters.read |
| Filters · Create | filters.create |
| Filters · Delete | filters.delete |
| Vacation responder · Read | vacation.read |
| Vacation responder · Change | vacation.update |
| IMAP · Read | imap.read |
| IMAP · Change | imap.update |
| POP · Read | pop.read |
| POP · Change | pop.update |
| Language · Read | language.read |
| Language · Change | language.update |
| Delegates · Read | delegates.read |
| Delegates · Create | delegates.create |
| Delegates · Delete | delegates.delete |
| Custom rule: a method and a path that you choose. | |
| KeyContain connects with a service account key that has domain-wide delegation, and acts as the super admin whose email you enter. | |
| Your agent adds the DNS records for domain verification and DKIM through a DNS service on the same key, such as Cloudflare. | |
| You generate the DKIM key in the Google Admin console. A personal Gmail account adds a send-as address in its own Gmail settings, with steps from your agent. | |