Google Workspace permissions,
in plain English.
When you connect an agent to your Google account, Google shows a consent screen that lists the permissions it wants. When several permissions are requested, you may be able to untick some of them. Apps given domain-wide access by a Google Workspace admin, or apps marked as trusted, skip that screen and get either all the permissions or none. You can remove an app's access at any time from your Google Account settings.
- Full Gmail access
This is the widest Gmail permission. The agent can read, write, send and permanently delete any email in your account. Google tells app makers to ask for it only if they need to delete mail for good, skipping the trash. - Read, send and organize Gmail
The agent can read all your email, write and send email as you, and sort, label or trash messages. It cannot permanently delete messages while skipping the trash, but it can permanently delete drafts and labels. - Read Gmail
The agent can open and read all your email, attachments and Gmail settings. It cannot send, change or delete anything. - Send email as you
The agent can send email from your Gmail address to anyone. It cannot read your inbox. - Write drafts and send email
The agent can create, edit and send drafts, and send new email as you. It can also see your drafts. It cannot read the rest of your inbox. - Change Gmail settings and filters
The agent can change your Gmail settings and create filters that act on new mail automatically. Filters can label, archive, trash or forward incoming email. - Full Google Calendar access
The agent can see, change, share and permanently delete every calendar you can access, and all the events on them. - View and edit calendar events
The agent can see, create, change and delete events on all your calendars. It can also send invites, updates and cancellations to your guests. - View calendars
The agent can see and download every calendar you can access, with full event details. It cannot change anything. - Full Google Drive access
The agent can open, download, change, share and delete any file in your Google Drive. Some deletes skip the trash and are permanent. - View and download all Drive files
The agent can open and download every file in your Google Drive. It cannot change, share or delete anything. - Only files you pick or it creates
The agent can only reach Drive files it creates or files you choose to open with it. Within those files, it can read, edit, share and delete. Google recommends this narrower option for most apps. - Edit all Google Sheets
The agent can open, create and edit every Google Sheets spreadsheet you have. Access covers the whole spreadsheet, not just one tab. - View all Google Sheets
The agent can open and read every Google Sheets spreadsheet you have. It cannot change them. - Edit Google Contacts
The agent can see, add, change and permanently delete your Google Contacts. - View Google Contacts
The agent can see and download your Google Contacts. It cannot change or delete them.
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.