62 Config-as-code with reconciliation

Caveats

• Not every Workspace setting is exposed by an API¹
• The reconciler is itself a top-tier persistence target²
• Converging before the dry-runs are clean will enforce your mistake tenant-wide³

Setup steps

1. Put the desired-state config in git: GAM batch files and/or Policy API JSON for 2SV enforcement, OAuth allowlist, sharing settings, routing, roles.

   One repo, reviewed PRs, tagged releases

   the source of truth

   Policy API overview ↗

2. open ↗

   

   https://admin.google.com/ac/list/roles · captured 2026-07-15

   Account › Admin roles ↗

   Create a custom admin role scoped to exactly the settings the reconciler manages, and bind it to the reconciler's service account.

   Custom role = only the privileges under management; never Super Admin

   Assign specific admin roles ↗ Create, edit, and delete custom admin roles ↗

3. open ↗

   

   https://admin.google.com/ac/owl/domainwidedelegation · captured 2026-07-15

   Security › Access and data control › API controls › Manage Domain Wide Delegation ↗

   The reconciler calls the Admin SDK as ITSELF: a service account can hold an admin role directly, which is what makes step 2's custom role effective. Keep the Admin SDK service account out of domain-wide delegation — DWD grants access to all users' data — and confirm its client id is absent from the DWD list. Exception: Cloud Identity Policy API reads require super-admin access via domain-wide delegation, so keep that credential separate from the Admin SDK reconciler.

   DWD list: Admin SDK reconciler's client id = absent (it authenticates as itself with the role from step 2); Policy API reads use a separate super-admin DWD credential

   Control API access with domain-wide delegation ↗

4. Run the reconciler on a schedule: fetch live state, diff against the repo, and either report or converge.

   Mode = report-only first; converge only after a clean dry-run streak

   Listing and getting policies ↗

5. Fail the pipeline on any live-state delta that git did not author — that delta is either an outage or an intruder.

Ongoing maintenance

• automatable: script Per schedule: run the reconciler and commit the state.
• automatable: AI agent Per diff: review whether it is sanctioned change or drift.

How to verify

1. Run the reconciler in dry-run mode against the live tenant — zero diff means the code matches reality; any diff is either drift or an undocumented change.