Google Workspace - Forge

Forge uses a customer-owned Google OAuth refresh credential to collect directory and administrative context from the Admin SDK. This page describes the identity connection; Gemini usage and Drive attribution use separate connectors and scopes.

OAuth scopes

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
https://www.googleapis.com/auth/admin.reports.audit.readonly

The connection stores the OAuth client ID, refresh credential, token URI, and validated scopes. Client secrets and refresh tokens are write-only Forge-managed secrets.

Collection

Admin SDK resource	Forge inventory
Directory users	Primary email, display identity, state, and provider ID
Directory groups	Group email, name, and provider ID
Admin roles	Role definitions and role assignments
Token audit	OAuth token activity
Admin audit	Administrative changes
Login audit	Authentication activity
Drive audit	Workspace-level Drive audit context

Users resolve to Forge people by normalized primary email. Groups resolve by Google provider ID and then by safe email/name matching. The identity connection does not import Drive label taxonomy or claim that generic Drive audit records are agent activity.

Setup

Enable the Admin SDK in the Google Cloud project that owns the OAuth client.
Authorize the scopes above with an account that can read the target Workspace customer.
Save the OAuth client ID, client secret, refresh token, token URI, and scopes under Settings → Integrations → Google Workspace identity.
Validate the connection, then run an inventory sync.
Compare a known user, group, admin-role assignment, and recent audit event with the Google Admin console.

Connector	Separate purpose
Gemini	Gemini for Workspace feature and usage posture from Admin Reports
Google Drive	Drive audit attribution, file metadata, and published label taxonomy

An access token can validate while an individual Admin SDK collection returns 403. Review the missing scope and the authorizing administrator’s role for that resource rather than broadening all Workspace access.