What can an AI agent do with
Read Gmail?
The agent can open and read all your email, attachments and Gmail settings. It cannot send, change or delete anything.
How to spot it
On a Google Workspace connection or settings screen, this is https://www.googleapis.com/auth/gmail.readonly.
With it, an agent can
- Read every email in your account, old and new
- Open and download attachments
- See your drafts
- See your Gmail settings and filters
It cannot, on its own
- Send email
- Trash or delete email
- Change labels or mark mail as read
- Change your settings or filters
What a bad day looks like
If the agent is tricked or the company behind it is breached, everything in your inbox is exposed, including invoices, customer details and password reset emails.
Set it up safer
- If it only needs senders, subjects and dates, ask for https://www.googleapis.com/auth/gmail.metadata, which leaves out the email body.
- Connect a separate mailbox that holds only the mail the agent needs.
Ask the company selling the agent
- Do you store copies of my email, and where?
- Who at your company can see my email?
- How do I delete my data if I stop using you?
Source
Checked against Google Workspace documentation on 2026-09-28. All Google Workspace permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.