# Google connector

> Work Google runs through an admin completed setup, then each member opts in their mailbox. New links in a personal workspace are temporarily unavailable.

Google comes in two distinct lanes: a work lane for team workspaces, and a
personal lane that is temporarily closed to new links.

## Work Google in a team workspace

A workspace admin completes the Work Google setup in the workspace's
Integrations tab. This connects the company's Google domain under admin
governance; it is an admin wizard on that tab, never an in chat card. Once the setup is
active, each member opts in their own work mailbox with one tap, either from
the Integrations tab or from a link card an agent offers in chat (see
[How account linking flows work](https://bolter.chat/help/connectors/linking-flows)).

The setup shows the client ID a super admin authorizes, and the full scope
list for each tier with a Copy scopes button beside it. Those lists copy comma
separated, which is the format the Google Admin console's scopes field expects,
so the paste goes in as is with nothing to edit by hand.

Starting that setup is not the same as finishing it. Google Workspace shows
"Awaiting verification" until a super admin has authorized Bolter's client for
the scopes in the Google Admin console and then pressed Verify on the
Integrations tab. While it says that, nothing reads anything: members cannot
opt in their work mailbox, and no agent can reach Gmail, Calendar, or Drive.
The tile only reads Connected once verification has passed at least once. A
connection that says Paused is a different thing: it was set up, it worked, and
an admin turned it off, so resuming it needs no trip to the Admin console.

The work lane is read only by default: agents granted access can read Gmail,
Calendar, and Drive. A wider tier that allows sending mail, writing calendar
events, and creating or editing the agent's own Drive files exists, but raising
the ceiling is an admin decision made in the setup, not something an agent or a
re-link can do. The admin authorizes the wider scopes in the Google Admin
console, then switches the Work Google connection to "Read and write" on the
Integrations tab. Raising the tier alone grants no agent anything: the grant
still has to carry the write option, as the next section explains.

## Two layers sit between an agent and a Google write

Sending mail, changing a calendar, and writing a file each need two separate
permissions, and both have to be in place.

1. **The connection's tier**, on a work Google connection only. This is the
   ceiling the workspace admin authorized in the Work Google setup, read only
   by default. Nothing an agent or a member does raises it.
2. **The agent's own grant.** Sending mail, writing calendar events, and
   writing files are separate opt ins on the grant itself, approved by the
   grant's owner on the approval card. A grant that covers Calendar but does
   not tick the calendar write option can read the calendar and nothing more.

Reading never needs either write permission. So an agent can be blocked on a
write for two quite different reasons, and the fix differs: if the tier is
still read only, an admin raises it in the Work Google setup; if the tier
already allows writes, the agent asks for the missing option on its grant, or
you edit the grant and tick it yourself. An agent that has just been refused a
write should say which of the two is missing. If it sends you to an admin who
has already raised the tier, check the grant.

## Files on shared drives

Agents read files on shared drives, not just files in a member's own My Drive.
Team owned folders such as contracts or procurement are usually shared drives,
and an agent granted Drive access reads them the same way it reads anything
else. You do not have to move a file into someone's My Drive to make it
readable.

What decides whether an agent can open a file is who the file is shared with.
A work Google connection reads as the member who opted in their mailbox, so an
agent reaches exactly the files that member can already open in Google, and
nothing more. If an agent reports that a file or folder cannot be found, share
it with that member in Google, or check that their access was not removed. A
file the member cannot open is a file the agent cannot open.

Two things worth knowing when a folder looks empty. Google reports a file you
cannot access as missing rather than as forbidden, so "not found" can mean the
file is not shared with you, and it can equally mean the link or id is wrong,
stale, or points at something deleted. An agent should tell you both are
possible rather than pick one, and you can settle it by opening the file
yourself as the member whose mailbox is connected.

And moving a folder into a shared drive can change who reaches it. Permissions
someone was given directly on the folder or file usually travel with it, but
access that came from the folder's old parent does not, because it was
inherited rather than granted. Someone who could only see the folder through
where it used to live loses it, without anyone having changed the folder.
Adding that person to the shared drive restores it.

## Putting time on a calendar that is not connected

Not every calendar is connectable. iCloud in particular has no connector, so an
agent cannot write to an iCloud calendar the way it writes to a connected Google
one. There are two ways around it. You can add an app-specific password as a key
and let the agent work with the iCloud calendar directly, described under
"Pasted API keys" in Connected accounts and grants. Or, without setting anything
up, you can get the time blocked out by inviting the calendar instead of writing
to it.

Ask the agent to create the event on a calendar it can already write to, and to
add the other calendar's address as an invitee. A blocking evening event on your
work calendar, inviting your personal address and anyone else who needs to be
there, arrives as an ordinary invitation. Accept it on your phone and it appears
in your personal calendar. Everyone invited sees the same event, and the times
stay in sync if it moves.

This needs the same two permissions as any other calendar write: a connection
tier that allows writes, and the calendar write option on the agent's grant. Two
things to know before relying on it. The event belongs to the calendar it was
created on, so edits, cancellations and the organizer's name all come from
there. And invitees see the address that created it, which may not be the one
you would have chosen for a personal evening.

## Personal Google: new links are temporarily unavailable

Linking a new Google account inside your personal workspace, such as an
@gmail.com address, is refused right now. Bolter's Google app is pending
Google's verification, and until it passes, new links from a personal
workspace are refused. Team workspaces are unaffected. Do not expect an
agent to offer one, and be wary of any instruction that claims otherwise.

## Work accounts are refused on the personal lane

An account on a company Google domain can never be linked as a personal
account. If you try, the link is refused and you are steered to the admin
completed Work Google setup for your workspace, so work email is only ever
connected under your company's own authorization.

## Already linked accounts keep working

If a personal Google account was linked in the past, it still works: agents
that hold a grant on it can keep reading Gmail and Calendar through it, and
re-linking that same account to refresh it remains possible. The pause only
blocks brand new links inside a personal workspace; it does not touch
accounts already linked, or new Work Google setups in a team workspace.

Source: https://bolter.chat/help/connectors/google_workspace