> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

> Connect Workspace directory, admin roles, token activity, and audit context.

Forge uses a customer-owned Google OAuth refresh credential to collect
directory and administrative context from the Admin SDK. This page describes
the identity connection; Gemini usage and Drive attribution use separate
connectors and scopes.

## OAuth scopes

```text theme={"system"}
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
https://www.googleapis.com/auth/admin.reports.audit.readonly
```

The connection stores the OAuth client ID, refresh credential, token URI, and
validated scopes. Client secrets and refresh tokens are write-only
Forge-managed secrets.

## Collection

| Admin SDK resource | Forge inventory                                         |
| ------------------ | ------------------------------------------------------- |
| Directory users    | Primary email, display identity, state, and provider ID |
| Directory groups   | Group email, name, and provider ID                      |
| Admin roles        | Role definitions and role assignments                   |
| Token audit        | OAuth token activity                                    |
| Admin audit        | Administrative changes                                  |
| Login audit        | Authentication activity                                 |
| Drive audit        | Workspace-level Drive audit context                     |

Users resolve to Forge people by normalized primary email. Groups resolve by
Google provider ID and then by safe email/name matching. The identity
connection does not import Drive label taxonomy or claim that generic Drive
audit records are agent activity.

## Setup

1. Enable the Admin SDK in the Google Cloud project that owns the OAuth client.
2. Authorize the scopes above with an account that can read the target
   Workspace customer.
3. Save the OAuth client ID, client secret, refresh token, token URI, and scopes
   under **Settings → Integrations → Google Workspace identity**.
4. Validate the connection, then run an inventory sync.
5. Compare a known user, group, admin-role assignment, and recent audit event
   with the Google Admin console.

## Related connectors

| Connector                                  | Separate purpose                                                     |
| ------------------------------------------ | -------------------------------------------------------------------- |
| [Gemini](/integrations/gemini)             | Gemini for Workspace feature and usage posture from Admin Reports    |
| [Google Drive](/integrations/google-drive) | Drive audit attribution, file metadata, and published label taxonomy |

An access token can validate while an individual Admin SDK collection returns
`403`. Review the missing scope and the authorizing administrator's role for
that resource rather than broadening all Workspace access.