PavedAgents

Connect Google Workspace

Here is exactly what we'd read.

PavedAgents works from connection records your Google admin console already keeps. A super admin approves three admin scopes. We never read email, files or calendar contents, and we never contact your employees.

1. admin.reports.audit.readonlyRead-only

   Which apps people connected, revoked or used, and when.

   Calls we make: activities.list (applicationName=token), activities.list (applicationName=login). Nothing else.

2. admin.directory.user.readonlyRead-only

   Names and teams, so results read "Finance" and not a list of IDs.

   Calls we make: users.list. Nothing else.

3. admin.directory.user.securityRead-write (no read-only version exists)

   The current list of apps each person has connected, including ones older than 180 days.

   Calls we make: users.tokens.list. Nothing else.