Google Workspace

Services included

Agents reach Google Workspace through the Google Workspace CLI, which runs in the agent’s sandbox — so this integration is only available on agents that have the sandbox capability enabled.

There are two ways to connect, and they differ in what the agent can reach.

Service	Sign in with Google	Service account (Workspace admin)
Google Docs	Read and write document content	same
Google Sheets	Read and update spreadsheet cells	same
Google Slides	Create and edit presentations	same
Google Forms	Create forms and read their responses	same
Google Contacts	Look up contacts to address a message	same
Google Calendar	Read events, create events, check availability	same
Google Drive	Create and upload files. Listing or reading existing files is not available	Full read and write
Gmail	Send email. Reading, searching, replying and forwarding are not available	Read, search, triage, reply, forward

Sign in with Google is the default and takes seconds. It requests only the permissions Google classifies as non-sensitive or sensitive, which is why reading Drive and Gmail is not on the list — those need Google’s restricted permissions.

Service account is for organisations that need those. A Google Workspace administrator authorises a service account in their own Admin Console, and the agent then acts as one named Workspace user. It is behind Advanced — Workspace admin in the connect dialog.

Before choosing a service account

Domain-wide delegation is powerful and needs a deliberate decision:

• It requires a Google Workspace administrator. Personal @gmail.com accounts cannot use it.
• The agent acts as one licensed user account. Google Groups and email aliases cannot be used — so a shared support@ address that is a Group will not work.
• The permissions are set in your Admin Console, not by Auteryn, and you can revoke them there at any time by deleting that row. It takes effect immediately.

Auteryn shows you the exact permission list to authorise and asks you to confirm the user address before accepting the key.

Calendar is a separate connection

Google Calendar is also available as its own connection (Console → Integrations → Google Calendar), with full calendar access, so agents can read, create and update events. To receive customer email, use the Email channel (Console → Integrations → Email): forward your support inbox to the Auteryn address it gives you.

---

Connecting Google Workspace

1. Go to Console → Integrations → Google Workspace
2. Click Connect Google
3. Choose which Google account to connect

To use a service account instead, expand Advanced — Workspace admin in the same dialog. Auteryn walks you through the Admin Console step and then runs a live test, so you find out immediately whether the authorisation worked rather than when an agent first tries to use it. 4. Grant the permissions requested 5. Click Allow

The agent using this connection must have the sandbox capability enabled — the Google Workspace CLI runs inside the sandbox.

Personal vs. service account

A personal Google connection acts as you and is private to you by default — teammates must be granted access before they can use it, and it’s revoked if you leave the organization. A service account is shared with the whole team and stays durable no matter who comes or goes. For shared team deployments, connect using a Google service account rather than a personal account.

Connect with a service account (admins)

For org-wide automation, connect Workspace as a service account with domain-wide delegation instead of a personal sign-in:

1. In Google Cloud, create a service account, enable domain-wide delegation, and authorize its client ID for the Workspace scopes you need (Admin console → Security → API controls)
2. Download the service account’s JSON key
3. In Console → Integrations → Google Workspace, choose Service account, paste the JSON key, and enter the delegated subject — the Workspace user the automation acts as (e.g. automation@yourcompany.com)
4. Save — Auteryn validates the key shape and mints delegated tokens automatically at run time

The connection is labeled Shared · team: one org-constant identity, no per-person credentials, unaffected by anyone leaving.

---

Example tasks

Google Drive / Docs

• “Create a new Google Doc titled ‘Meeting Notes - April 1’ with the following content…”
• “Save this report as a file in my Drive”

Google Sheets

• “Read the data from Sheet 1 of the ‘Sales Tracker’ spreadsheet”
• “Update cell B5 in ‘Budget 2025’ to 45000”

Google Calendar

• “What meetings do I have tomorrow?”
• “Create a 30-minute meeting called ‘Sprint Planning’ on Friday at 2pm for me and alice@acme.com”
• “Find a free slot this week for a 1-hour meeting with alice@acme.com”