Google Governance Control

Sign in

ACL rules

Edit individual rows or select multiple rules and apply a bulk decision. Row decision changes auto-save.

select shown0 selected

	Decision	Agent Identity	Workspace	Route	Action	Service

Approvals

Requests waiting because an ACL decision is set to ask. Approve with ✓ to execute immediately, or deny with ✕.

Request	Profile	Action	Resource	Requested	Expires	Status	Approver	Details

Live gateway access log

Plain-English view of what Google Workspace access the gateway processed. Times display in CST/CDT.

Time (CST/CDT)	Profile	Action	Decision	Outcome	Route	Info

These same gateway audit rows are exported to Loki/Grafana via job google-workspace-governance-audit.

MCP tools

Exposed governed Google MCP tools. Pick a profile, then an applicable Workspace route, then a safe directly-testable read tool.

Test a tool

agent entityApplicable Workspace routeTool

The tester intentionally offers safe read tools that this UI can execute directly. The catalog below lists every exposed MCP tool, including write/destructive tools that require a real MCP client or approval flow.

Request JSONResponse

Pick a profile, route, and supported safe read tool, then run a test.

Exposed MCP tool catalog

Tool	Service	Risk	Description

Profile settings

User profile

Signed in as

Profile photo preview

Agent entities

Available entities and your assignments

Loading agent entities…

Two-factor authentication

Loading 2FA status…

Authenticator app

Use a 6-digit code from your authenticator app after password sign-in.

Passkey

Passwordless sign-in. One passkey is allowed per user.

YubiKey / FIDO 2FA

Strictly a second factor after password sign-in. Register multiple physical keys and name each one.

YubiKey name

Registered YubiKeys0

No YubiKeys registered.

Workspace Configuration

✓ Test the existing token.

↻ Refresh the current access token using the saved refresh token.

🔐 Reopen Google consent and update scopes on this same workspace row.

⛓ Disconnect the workspace token and remove its routes/ACL visibility.

Email	Token	Account	Owner	Store	Status	Updated	Actions

Configure new workspaceUpload OAuth client JSON and connect a Google account

Connect Google accounts here. Connection only stores gateway-owned OAuth custody. No profile ACLs are created during this step.

1. Upload client_secret.jsonUse the Google OAuth Desktop App client secret from your Google Cloud project.

2. Workspace NameGive this connected workspace a required friendly display name, such as Work Gmail or Family Workspace.

3. Generate authorization URLagent runtime generates the Google OAuth authorization URL using the configured OAuth app. Workspace services/scopes come from the Google Cloud project configuration.

4. Approve in browserOpen the authorization URL, sign in with your Google account, and approve access.

5. Save tokenPaste the returned authorization response back into agent runtime. agent runtime will save the token for future use. No profile ACLs are created during this connection step.

Choose Workspace tokens and agent entities to create agent-entity/token routes. Routes are always agent-entity/account, for example agent-b/work-gmail. Need one? Open Configure Agent Identity above first.

Workspace tokens

Select one or more connected Google accounts.

0 selected

Agent entity

Select one or more agent entities to link.

0 selected

Creates every selected token × selected agent entity combination.

Agent entity	Account	Route shown in ACL	Email	Owner	Actions

Channel Configuration

Connection Status

Not loaded

Bot account that sends approval messages.

Enabled

Not loaded

Off means approvals appear only in this UI.

Approval user / approver	Telegram user	Chat	Agent ACL	Governance bot	Status	Action

Add governance approval userTelegram chat where access approvals are sent

Approval user labelThe user/principal boundary that owns this approval bot and ACL.Approver Telegram chat IDThe DM/group for this approval user’s approver(s).Dedicated governance bot tokenOne governance-owned bot per approval user. Do not use agent chat bots.Agent ACLWhich agent entities can request approvals from this approval user.agent entityMapped into this approval user’s ACL.StatusDisable this approval route without deleting it.

System Settings

Runtime status

Operational health, source sync, defaults, and fast service actions.

Gateway health

unknown

Service endpoints

Gateway

Control bind

Auth

Reload mode

Policy defaults

Unknown profile

Unknown resource

Grafana/Loki{job="google-workspace-governance-audit"}

Version / source sync

Loading version…

Loading database backend…

Create the first admin

Sign in

ACL rules

Approvals

Live gateway access log

MCP tools

Test a tool

Profile settings

User profile

Agent entities

Two-factor authentication

Authenticator app

Passkey

YubiKey / FIDO 2FA

User management

OIDC SSO setup

What to enter

1. Sign-in behavior

2. Identity provider app

3. Callback and access guardrails

Create user

Workspace Configuration

Workspace tokens

Agent entity

MCP Authorization

Channel Configuration

WhatsApp approvals

Webhook approvals

Email approvals

System Settings

Runtime status

Config validation

Backups

Create backup

Upload / validate

Scheduled backups

Postgres migration

Migration controls

File locations

Upgrade & logs