Skip to main content
Forge uses Google Workspace Admin Reports to collect Gemini for Workspace feature and usage posture. This integration is intentionally narrower than Google Workspace identity and Google Drive attribution.

​
Scope

Admin Reports records remain inventory and usage evidence until Forge can prove that a record represents a specific agent session. They are not automatically shown as complete prompt/response sessions.

​
Access

Forge’s Google OAuth connection requests:
Save the Workspace customer ID, admin email, OAuth client ID, and OAuth project ID when using customer-owned OAuth configuration. The refresh credential is stored as a Forge-managed secret.

​
Setup

  1. Open Settings → Integrations → Google Workspace Gemini and complete the admin OAuth flow.
  2. Confirm the authorized account can read Admin Reports for the target customer.
  3. Test the connection, then sync the gemini_in_workspace_apps feed.
  4. Verify a known feature-utilization record and its actor/customer references in Forge.

​
Runtime boundary

Google Workspace side-panel Gemini does not expose a universal public compliance API for prompt and response content. Workspace Studio console exports are not a production Forge ingestion path. Supported Gemini browser and developer API traffic can be governed separately through agentless Network routing or Device Agent’s transparent proxy. Forge reroutes selected traffic through the LLM Gateway for content policy and session visibility. Connect Google Workspace for directory and admin context, and Google Drive for Drive audit attribution and labels.

​
Verification

A healthy empty feed means Google accepted the Reports request but returned no records for the selected window. 403 generally indicates missing Reports scope or admin authority; a connected tenant with no Gemini records may also indicate product licensing or that the report is not emitted for the enabled Workspace features.