When you build and run automated flows in Google Workspace Studio, security and data privacy are built in by default. Workspace Studio uses a least-privileged identity model, which means that automated flows run background tasks using only the minimum permissions required to perform each individual action, instead of having broad, unrestricted access to the user’s entire Google Account.
To safely configure your automation and maintain visibility into how your organization's data is accessed, use this guide to identify the permissions required for each step in a flow. This page provides a mapping of each flow step type and its required Open Authorization (OAuth) scopes.
How OAuth scopes impact your use of Studio
When you use Workspace Studio, OAuth scopes impact how you build, run, and manage your flows in these ways:
- One-time authorization: The first time you add a step that interacts with a Google service (like Gmail or Google Drive), you’ll get a Google sign-in prompt. This authorizes the specific scope for that step so that the flow can run independently in the background.
- Asynchronous background execution: After a flow is turned on, it runs asynchronously on Google's infrastructure. The flow carries out tasks (like scheduling a Calendar event or writing a draft) using only the specific scopes you approved, even when you aren't actively signed in.
- Centralized admin oversight: As an admin, you can view all active flows across your organization using the Agent Access Management settings in your Admin console. You can pause specific flows or target and restrict individual OAuth scopes (like removing Drive access while leaving Gmail active) to keep your organization's data safe. Learn more
Troubleshoot insufficient permissions
If a flow doesn't run and shows an "Insufficient Permissions" or "Something went wrong" error in the Activity Log, check the following:
- Re-authorize your flow: Open the flow in the Builder, click Save Changes, and follow any prompts in the authorization box to refresh expired or missing OAuth tokens.
- Context-Aware Access (CAA) blocks: If your organization strictly enforces device or IP policies, background flow executions can sometimes be blocked. Make sure the core Workspace Studio Client ID is exempt from CAA restrictions.
Flow steps and required OAuth scopes
This table outlines standard Workspace Studio steps and the OAuth scopes each step requires to run behind the scenes.
| Step name | Configuration and scope |
|---|---|
| Studio AI steps | |
| AIP primitives (Ask Gemini, Ask a Gem, Create with Gemini, Deep Research, Recap unread emails, Extract, Decide, Summarize) | https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/cloud_search.query |
| General and utilities | |
| On a schedule | N/A |
| Send webhook | N/A - External 3P |
| Check if | N/A - Internal logic |
| Filter a list | N/A - Internal logic |
| Gmail | |
| When I get an email | https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/gmail.event_trigger https://www.googleapis.com/auth/workspace.workflows.trigger |
| Notify me by email | https://www.googleapis.com/auth/gmail.send https://www.googleapis.com/auth/gmail.readonly |
| Send an email | https://www.googleapis.com/auth/gmail.send https://www.googleapis.com/auth/gmail.compose https://www.googleapis.com/auth/gmail.readonly |
| Draft an email | https://www.googleapis.com/auth/gmail.compose https://www.googleapis.com/auth/gmail.send https://www.googleapis.com/auth/gmail.readonly |
| Forward an email | https://www.googleapis.com/auth/gmail.send https://www.googleapis.com/auth/gmail.compose https://www.googleapis.com/auth/gmail.readonly |
| Draft a reply | https://www.googleapis.com/auth/gmail.compose https://www.googleapis.com/auth/gmail.readonly |
| Reply to an email | https://www.googleapis.com/auth/gmail.compose https://www.googleapis.com/auth/gmail.readonly |
| Add or remove labels | https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/gmail.readonly |
| Mark read or unread | https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/gmail.readonly |
| Star or unstar | https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/gmail.readonly |
| Archive (or delete) | https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/gmail.readonly |
| Google Chat | |
| When someone joins a space | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/chat.memberships.readonly https://www.googleapis.com/auth/chat.messages.readonly https://www.googleapis.com/auth/chat.memberships https://www.googleapis.com/auth/chat.spaces |
| When I get a chat message | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/chat.memberships.readonly https://www.googleapis.com/auth/chat.messages.readonly https://www.googleapis.com/auth/chat.memberships https://www.googleapis.com/auth/chat.spaces |
| When I'm mentioned | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/chat.messages.readonly https://www.googleapis.com/auth/chat.memberships.readonly https://www.googleapis.com/auth/chat.memberships https://www.googleapis.com/auth/chat.spaces |
| When an emoji reaction is added | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/chat.messages.readonly https://www.googleapis.com/auth/chat.memberships.readonly https://www.googleapis.com/auth/chat.memberships https://www.googleapis.com/auth/chat.spaces |
| Notify me in Chat | https://www.googleapis.com/auth/chat.messages.create https://www.googleapis.com/auth/chat.spaces https://www.googleapis.com/auth/chat.memberships.app https://www.googleapis.com/auth/chat.memberships.readonly https://www.googleapis.com/auth/chat.memberships |
| Send chat space | https://www.googleapis.com/auth/chat.messages.create https://www.googleapis.com/auth/chat.spaces.create https://www.googleapis.com/auth/chat.spaces.readonly https://www.googleapis.com/auth/chat.memberships https://www.googleapis.com/auth/chat.spaces |
| Send to others | https://www.googleapis.com/auth/chat.messages.create https://www.googleapis.com/auth/chat.spaces https://www.googleapis.com/auth/chat.memberships.app https://www.googleapis.com/auth/chat.memberships.readonly https://www.googleapis.com/auth/chat.memberships |
| Reply to message | https://www.googleapis.com/auth/chat.messages.create https://www.googleapis.com/auth/chat.spaces https://www.googleapis.com/auth/chat.messages.readonly https://www.googleapis.com/auth/chat.spaces.readonly https://www.googleapis.com/auth/chat.memberships.app https://www.googleapis.com/auth/chat.memberships.readonly https://www.googleapis.com/auth/chat.memberships |
| Google Sheets | |
| When sheet changes | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.readonly |
| Add a row | https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.metadata.readonly |
| Update rows | https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.metadata.readonly |
| Clear rows | https://www.googleapis.com/auth/spreadsheet https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.metadata.readonly |
| Get sheet contents | https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.metadata.readonly |
| Google Docs | |
| Create a Google doc | https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive.metadata.readonly https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/drive.readonly |
| Add to a doc | https://www.googleapis.com/auth/drive.metadata.readonly https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/drive.readonly |
| Google Calendar and Tasks | |
| Based on a meeting | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/calendar.events.readonly |
| Create task | https://www.googleapis.com/auth/tasks |
| Create event | https://www.googleapis.com/auth/calendar.events |
| Add guests | https://www.googleapis.com/auth/calendar.events |
| Google Drive | |
| When an item is added to a folder | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive.metadata.readonly |
| When a file is edited | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.metadata.readonly |
| When an item in a folder is edited | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive.metadata.readonly |
| Move file | https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/drive.metadata.readonly https://www.googleapis.com/auth/drive.readonly |
| Copy file | https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/drive.metadata.readonly https://www.googleapis.com/auth/drive.readonly |
| Save attachments | https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/drive.metadata.readonly https://www.googleapis.com/auth/drive.readonly |
| Create a folder | https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive.metadata.readonly https://www.googleapis.com/auth/drive.readonly |
| Google Meet | |
| When meeting notes | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/drive.meet.readonly https://www.googleapis.com/auth/meetings.space.created https://www.googleapis.com/auth/calendar.events.readonly https://www.googleapis.com/auth/meetings.space.readonly |
| Google Forms | |
| When a form response comes in | https://www.googleapis.com/auth/workspace.workflows.trigger https://www.googleapis.com/auth/forms.responses.readonly https://www.googleapis.com/auth/forms.body.readonly https://www.googleapis.com/auth/drive.readonly (only for DLP file support in Forms) |
| NotebookLM | |
| Add Source to NotebookLM | https://www.googleapis.com/auth/drive.readonly |
| Ask NotebookLM | https://www.googleapis.com/auth/drive.readonly |