8 OAuth app access control / allowlisting

By default any user can grant a third-party app OAuth scopes over their Workspace data, and the grant survives password resets. This control inverts the default: unconfigured apps are blocked, and every app holding a Workspace scope is explicitly Trusted, Limited, Specific Google data, or Blocked, with access requests worked from the shared 'Apps pending review' queue. It also covers the domain-wide delegation table, where a client ID impersonates users with no user consent at all — the highest-value list in the tenant.

Caveats

Setting the default to Restricted revokes tokens for apps you haven’t trusted¹
Domain-wide delegation bypasses app access control entirely²
‘Trusted’ means all scopes, present and future³
Most Google-owned apps are Trusted by default⁴

Setup steps

open ↗
https://admin.google.com/ac/owl · captured 2026-07-15
Security › Access and data control › API controls
Open API controls > Settings and set the default for apps you have not explicitly reviewed. This is the switch that turns OAuth from allow-by-default into allow-by-exception.

Unconfigured third-party apps
Don't allow users to access any third-party apps

Control which apps access Google Workspace data ↗
open ↗
https://admin.google.com/ac/owl/list?tab=configuredApps · captured 2026-07-15
Security › Access and data control › API controls › App access control
Open 'Manage third-party app access' and work the Accessed apps / Apps pending review lists: every app currently holding a Workspace scope must be explicitly Trusted, Limited, Specific Google data, or Blocked.

Per app: Trusted (all scopes) only for apps with an owner and a business case; everything else = Blocked

Control which apps access Google Workspace data ↗
open ↗
https://admin.google.com/ac/owl/settings · captured 2026-07-15
Security › Access and data control › API controls › App access control
Decide whether users may request access to blocked apps. Requests land in the shared 'Apps pending review' list, visible to any admin with the Service Settings privilege — assign an owner to work that queue. Not available for Google Workspace for Education editions.

Allow users to request access to unconfigured third-party apps = On (with the 'Apps pending review' queue actively monitored) or Off

Review & manage third-party app access requests ↗
open ↗
https://admin.google.com/ac/owl/domainwidedelegation · captured 2026-07-15
Security › Access and data control › API controls › Manage Domain Wide Delegation
Audit the domain-wide delegation table. Each client ID here impersonates users without any user consent — this is the highest-value list in the tenant.

Remove every client ID you cannot attribute to a current, owned integration; narrow remaining scopes to the minimum

Control API access with domain-wide delegation ↗

Ongoing maintenance

requires a human Weekly: review newly requested/configured apps and their scopes before approving.
automatable: AI agent Weekly: scan the configured-apps list for scope creep on already-approved clients.

How to verify

From a test account, authorise a random unconfigured third-party app against Drive scopes — the consent should be refused with the admin-configured message.
Confirm no wide-open default remains: API controls should show unconfigured third-party apps = blocked (or restricted).

v0.0.3Prevent policy #19 · #37 ↗