Manage work agent access to Google data

As an administrator, you determine how much access Google Workspace work agents have to Google data. By default, agents can request access to all Google data. However, you can override this for individual agents, or change the default and allow only limited access.

How data access works

Agent data access works similar to app access, where agents request access to Google data based on the following levels:

  • Trusted: Agent has access to all Google Workspace services (OAuth scopes), including restricted services.
  • Specific Google data: Agent can request data access only to scopes that you specify.
  • Blocked: Agent can't access any Google data, but can still do tasks for non-Google data requests.

Manage data access for individual agents

In your Admin console, you can see a centralized list of all Workspace work agents in one place, from which you can manage access to Google data individually.

  1. In your Admin console, go to Menu and then Agents and then Agent access management.
  2. In the row of the agent you want to manage, click Actions and then Change access.
  3. Update the access and click Save.
  4. (Optional) Alternatively, you can click Actions and then Pause data access. This is similar to changing the data access to Blocked.

If you partially or fully restrict access to Google data, Google Workspace Studio users see a banner on impacted agents.

Set the default access for work agents

  1. In your Admin console, go to Menu and then Agents and then Settings.
  2. Click Default access for Workspace agents.
  3. Select an option and click Save. The options correspond to the trusted and blocked data access levels listed earlier.

If you don't allow access to Google data, in Studio users see a banner on impacted agents.

Changes can take up to 24 hours but typically happen more quickly. Learn more

About pausing data access

When you pause data access for agents, their access to Google data is blocked until you unpause. Some agents might still run if they can do tasks using other data sources, like web search. The impact depends on the type of agent:

  • Studio flow: The flow can still run but can't use Google data sources. Users see errors in the activity log in Studio.
  • Google Workspace work agent: The agent loses access to Google data and any in-progress tasks stop immediately. To completely remove access to any stored context, the environment that the agent uses for some activity is deleted, preventing the agent from accepting any new tasks. Users see that the agent is restricted in Studio, and can still edit its configuration. To prevent users from editing a work agent while also stopping it, you can suspend it in the Google Workspace work agents list.
  • Gemini Enterprise: The agent loses access to Google data but can complete any existing tasks, if possible, and continues to accept new tasks. Users might see an error in the chat that the agent can't access required information.