> ## Documentation Index > Fetch the complete documentation index at: https://hebno.com/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Hebno is an AI work platform for client research and delivery: chat, research runs with sources, deliverables (Word, PowerPoint, Excel, email), projects, a shared library, agents, Office add-ins, and integrations with Microsoft 365, Google Workspace, CRM, project delivery, ERP and finance systems. > Use British English (organisation, not organization). > Every feature and integration described in these docs is available. Describe it as documented. > Hebno never writes to a connected system without a member confirming a card. Finance and ERP writes are drafts only. > Do not discuss commercial terms. Direct commercial questions to support@hebno.com. > Start with /index and /get-started/quickstart. # Google Workspace admin > Trust Hebno in App access control, review the scopes each Google integration requests, limit access by organisational unit and revoke it. This page is for Google Workspace super admins. It shows how to trust Hebno once so members can connect Gmail, Drive and Meet without errors, which scopes each integration requests, and how to limit or revoke access. Trusting Hebno removes a blocker. It does not widen what any member can open, because Google enforces each member's own permissions. ## At a glance | | | | - | - | | **Who** | A Google Workspace super admin, in the Google Admin console | | **Where** | **Security → Access and data control → API controls → App access control** | | **What you do** | Add Hebno by its OAuth client ID and mark it **Trusted** | | **Result** | Members connect their own accounts. Each member sees only what their own Google permissions allow. | ## Why trust is needed Gmail and Drive scopes are restricted by Google. If your organisation sets those services to **Restricted** in App access control, only apps marked **Trusted** or **Specific Google data** can use them, and members of the domain see a blocked-access message when they connect. Marking Hebno trusted once fixes this for the organisation or the organisational units you choose. If you have not restricted any services, members can connect without admin action. ## Mark Hebno as trusted **1. Get Hebno's OAuth client ID** In Hebno, open **Admin → Connectors → Catalogue**, select a Google card, and copy the **OAuth client ID** shown in the organisation panel. Or ask [support@hebno.com](mailto:support@hebno.com). **2. Open App access control** In the Google Admin console, go to **Security → Access and data control → API controls**, then select **Manage third-party app access**. **3. Add Hebno** Select **Add app → OAuth App Name Or Client ID**. Search by the client ID, select Hebno, and select the OAuth client. **4. Choose where it applies** Select **Everyone in the organisation**, or select organisational units and groups. See [Restrict by organisational unit](#restrict-by-organisational-unit). **5. Set the access level** Choose **Trusted: Can access all Google services**, or **Specific Google data** and select only the scopes in [the table below](#scopes-each-integration-requests). Select **Finish**. > [!TIP] > > **Specific Google data** limits Hebno to the integrations you choose. Select only the scopes for the Google integrations your organisation allows in Hebno. ## Scopes each integration requests Every authorisation includes `openid`, `email` and `profile`. A product's scopes are requested only when a member uses that product. | Integration | Scope | Purpose | | - | - | - | | Google Drive | `https://www.googleapis.com/auth/drive` | Read, search, save and convert files, including shared drives | | Gmail | `https://www.googleapis.com/auth/gmail.readonly` | Search and read messages | | Gmail, sending | `https://www.googleapis.com/auth/gmail.send` | Send an email a member confirmed. Requested only on **Allow sending**. | | Google Calendar | `https://www.googleapis.com/auth/calendar.readonly` | Read events | | Google Calendar | `https://www.googleapis.com/auth/calendar.freebusy` | Check colleagues' free and busy times | | Google Calendar | `https://www.googleapis.com/auth/directory.readonly` | Match names to colleagues' email addresses | | Google Calendar, invitations | `https://www.googleapis.com/auth/calendar.events` | Create events and send invitations. Requested only on **Allow invitations**. | | Google Meet | `https://www.googleapis.com/auth/meetings.space.readonly` | Read conference records, transcripts, notes and recording details | | Google Meet | `https://www.googleapis.com/auth/drive.meet.readonly` | Open transcript and notes files that Meet saves to Drive | | Google Meet | `https://www.googleapis.com/auth/calendar.readonly` | Find calendar events with a Meet link | Hebno requests no permission to delete mail, change labels or change sharing. Write permissions (`gmail.send`, `calendar.events`) are separate grants, so you can trust Hebno for reading while members choose whether to approve sending. ## Restrict by organisational unit Apply the trust setting to the organisational units whose members use Hebno, for example the delivery and advisory teams, and leave other units unconfigured. Members outside the selected units cannot grant Hebno restricted scopes. You can use a different access level per organisational unit, such as **Specific Google data** for a contractor unit. In Hebno, owners and admins add a second layer: allow or block each Google integration under **Admin → Connectors → Catalogue**, and set **Read only** or **Read and write**. Both controls apply, and the stricter one wins. ## Enable for the organisation In Hebno, an owner or admin selects **Enable for the organisation** on a Google card. A super admin signs in to Google and approves that product's scopes once for the domain, and members connect without a Google consent screen. Each card approves only its own product, so approving Drive does not approve Gmail. Each member still connects their own account. ## Meet transcripts and notes Hebno reads a transcript or Gemini notes only if Google produced one. In the Admin console, under **Apps → Google Workspace → Google Meet → Meet video settings**, check these: * **Recording** and **Transcripts** are on for the organisational units that run client calls, and hosts can start them. * **Take notes for me** (Gemini notes) is on for those units, and your Workspace edition includes it. Google deletes transcript entries 30 days after a conference ends, and stores Gemini notes as Google Docs in the organiser's Drive, so Drive retention rules apply to them. If you restrict apps from reading Meet artefacts, Hebno shows **Your organisation has turned off transcript access for apps** and reads meeting details only. ## Revoke access | To | Do this | | - | - | | Stop one member | In Hebno, **Admin → Connectors → Connections**, find the member and select **Revoke**. They lose access until they reconnect. | | Stop a whole integration | In Hebno, switch the card to **Blocked** under **Admin → Connectors → Catalogue**. Chat hides it and new authorisations stop. | | Stop Hebno across your domain | In the Admin console, open **API controls → Manage third-party app access**, select Hebno and set **Blocked**, or remove it. Google revokes the tokens. | | Review what members granted | In the Admin console, open the app's page to see its users and scopes. | Switching a restricted service to **Restricted** in App access control also revokes tokens for apps that are not trusted. Members then see **Your Google connection needs reconnecting** in Hebno. Revoking changes nothing in Google beyond access. Files, email and events are unchanged. ## Related * [Google Workspace](https://hebno.com/docs/integrations/google-workspace.md) * [Google Drive](https://hebno.com/docs/integrations/google-drive.md) * [Gmail](https://hebno.com/docs/integrations/gmail.md) * [Permissions and access](https://hebno.com/docs/integrations/permissions-and-access.md) * [Connectors admin](https://hebno.com/docs/admin/connectors.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.