Google Workspace
One OAuth flow gives Trefur four complementary signals into Google's AI surface, plus a third-party OAuth-grant inventory for unmanaged AI discovery.
What you get
- Gemini in Workspace apps — Gemini activity inside Gmail, Docs, Sheets, Slides, and Meet, pulled from the Admin SDK Reports API.
- gemini.google.com (consumer) — activity from the Workspace-managed consumer Gemini surface, de-duplicated against the Workspace-app events so nothing is double-counted.
- Third-party OAuth-grant inventory — a rollup of the AI tools and integrations your users have granted access to, for unmanaged-AI discovery.
Vertex AI / Gemini API and Cloud Assist audit-log ingestion is configured through the separate Google Cloud connector, which requests Cloud Audit Logs access.
Setup
- Sign in to app.trefur.com with a Workspace super-admin account (required for org-wide Admin SDK scopes).
- Open Integrations → Google Workspace → Connect.
- Trefur shows the OAuth scopes that will be requested with a plain-English description of each.
- Confirm. You're bounced to Google's OAuth consent screen.
- On callback, Trefur runs an instant initial scan. Background polling continues on a five-minute cadence.
OAuth scopes requested
| Scope | What it grants |
|---|---|
https://www.googleapis.com/auth/chat.spaces.readonly | Read Google Chat spaces. |
https://www.googleapis.com/auth/chat.memberships.readonly | Read Google Chat space memberships. |
https://www.googleapis.com/auth/admin.reports.audit.readonly | Read Admin SDK audit reports. |
https://www.googleapis.com/auth/admin.directory.user.readonly | Read directory users. |
https://www.googleapis.com/auth/admin.directory.domain.readonly | Read domain metadata for the org. |
https://www.googleapis.com/auth/admin.directory.user.security | Read directory user security settings. |
https://www.googleapis.com/auth/drive.metadata.readonly | Read Drive file metadata. |
https://www.googleapis.com/auth/script.processes | Read Apps Script process activity. |
https://www.googleapis.com/auth/userinfo.email | Identify the connecting admin account. |
https://www.googleapis.com/auth/userinfo.profile | Read the connecting admin's basic profile. |
Note on Vertex AI prompt + response capture: the Cloud Audit Logs path does not include prompt or response bodies — Google's API does not surface them. To get prompt-level fidelity, install the Python SDK / JavaScript SDK directly in the agent process, or proxy outbound traffic through the collector's LLM proxy.
Disconnect
In the Trefur dashboard, open the integration and click Disconnect. Trefur revokes the refresh token immediately and purges scheduled scans. The historical telemetry it has already collected stays in your tenant.
Linked surfaces
- Unmanaged AI discovery — the OAuth-grant inventory feeds the unmanaged AI rollup.
- Multi-agent traces — Vertex AI tool-call activity stitches into multi-agent run trees.