ExplainerUpdated November 2, 2026

Does my AI agent need full access to Gmail?

An AI agent only needs full access to Gmail if it has to delete mail immediately and permanently, bypassing the trash. That is how Google itself justifies its broadest scope, https://mail.google.com/, and Google adds that every other action works with less permissive scopes[1]. An agent that summarizes needs to read; one that sorts needs to change labels. When a tool asks for full access anyway, it is worth finding out why.

Updated: Fact-checked: About 7 min readAs Markdown

Contents
  1. What the line on Google's consent screen means
  2. Why some apps and agents still ask for it
  3. Which rights common agent tasks need
  4. Why broad access weighs more for agents
  5. What ChatGPT, Claude and Google's Gmail MCP request
  6. How to check and revoke an app's access
  7. How Command Mail works without Gmail access
  8. Connect Command Mail to your agent
  9. Review status
  10. Frequently asked questions
  11. Sources

Google describes the scope https://mail.google.com/ as “Read, compose, send, and permanently delete all your email from Gmail”[1]. It covers every message in the account, old ones included, and permanent deletion that skips the trash. Google's developer documentation is explicit: request this scope only if the application needs to immediately and permanently delete threads and messages; all other actions can be done with less permissive scopes[1].

Google classifies the scope as restricted, as it does gmail.readonly, gmail.compose and gmail.modify. Public apps using such scopes must pass Google's restricted scope verification, and apps that store or transmit the data on servers also need a security assessment[1].

02Why some apps and agents still ask for it

Apps accessing Gmail over IMAP, POP or SMTP using OAuth 2.0 normally require exactly this scope. Google names https://mail.google.com/ as the scope for those protocols and tells apps that don't fully use it to migrate to the Gmail API and its more granular scopes[2]. The one exception Google lists is IMAP through domain-wide delegation with service accounts in Google Workspace, which uses gmail.imap_admin[2].

For a full email client this fits: it is meant to read, send and delete. An agent or MCP server built on IMAP inherits the same reach, even if all it does is write a morning summary. How such servers differ from hosted services is covered in IMAP MCP vs hosted MCP.

On Google's consent screen you can only untick whole scopes. If an app asks for at least one scope besides the sign-in scopes, or for several scopes without sign-in, Google shows checkboxes so you can decline individual permissions. If it asks for a single scope only, full access for example, there are no checkboxes; you allow or deny the whole request[3]. Workspace Enterprise apps with domain-wide delegation or marked as Trusted are not affected by this rule at this time, according to Google[3]. Unticking can therefore never turn full access into read-only access.

03Which rights common agent tasks need

The Gmail API has a narrower scope than full access for every common task. The table lists the smallest fitting scope according to Google and what else it allows.

What the agent doesSmallest fitting Gmail scopeAlso allowed, per Google
Search, read, summarize, daily briefgmail.readonlyviewing settings; no changes, no sending
Look at senders, subjects and labels onlygmail.metadatano access to the message body
Label messages, archivegmail.modifyreading, composing and sending; no immediate permanent deletion
Prepare draftsgmail.composesending
Send onlygmail.sendno reading
Delete immediately and permanentlyhttps://mail.google.com/everything

Two rows are broader than most people expect. Changing the labels on a message requires gmail.modify, full access, or an admin-only scope[4]; gmail.labels only lets an app see and edit the labels themselves[1]. And there is no draft-only scope: Google calls gmail.compose “Manage drafts and send emails”[1]. If a person should approve every message, that lock has to sit outside Google's permissions, in the software between the agent and Gmail. How permissions break down across providers is explained in Scopes for email agents.

04Why broad access weighs more for agents

An agent reads text written by strangers and decides what to do based on it. A crafted email can push it into actions you never asked for, as described in Prompt injection in email. What a manipulated agent can do then depends on its permissions.

OWASP describes this pattern as Excessive Agency and uses an email example. An assistant is meant to summarize incoming mail, but its extension can also send; a malicious email makes it scan the mailbox for sensitive information and forward it to the attacker[5]. OWASP's fixes are an extension that only reads, an OAuth session with a read-only scope, and a person who reviews and sends every drafted message; rate limiting outgoing mail can reduce the damage further[5].

05What ChatGPT, Claude and Google's Gmail MCP request

The common routes into Gmail request very different access. The table summarizes what the vendors published as of 2026-11-02.

RouteWhat it requests from GoogleSending, per source
ChatGPT, Gmail appgmail.modify according to OpenAI[6]the scope allows sending; which actions ChatGPT offers is up to ChatGPT
Claude, Google Workspace connectorAnthropic names no scope[7]send, reply, forward; Claude asks first by default, Team and Enterprise owners can allow exceptions[7]
Google's Gmail MCP (Developer Preview)gmail.readonly and gmail.compose in the setup[8]published tools don't send; the scope itself would allow it
Email clients and MCP servers over IMAP/SMTP using OAuth 2.0https://mail.google.com/[2]yes, plus permanent deletion
Forwarding to a serviceno Gmail scopedepends on the service

For Claude, your Google Account shows what access the app actually holds once connected[9] (see the next section). ChatGPT's own approval settings are covered in Can ChatGPT send emails?, and Google's server in detail in Gmail MCP server.

06How to check and revoke an app's access

Google lists every app with access to your account on the linked apps page[9]:

  1. Open myaccount.google.com/linkedapps in your Google Account.
  2. Select “Access to your Google Account”, then the app.
  3. Select “See details” and review its access.
  4. To revoke it, select “Remove access”, then “Confirm”.

After that the app can no longer access your account[9]. Data it copied before is not affected; Google notes that you may need to ask the developer to delete it[10].

App passwords are managed separately at myaccount.google.com/apppasswords[11]. Google describes an app password as a 16-digit passcode that gives a less secure app or device permission to access your Google Account, and recommends “Sign in with Google” wherever an app offers it[11]. When you change your Google Account password, Google revokes all your app passwords[11].

07How Command Mail works without Gmail access

Command Mail is our product. We checked the following statements against the app code at commit 60c8c3d.

Command Mail receives Gmail by forwarding. You set up forwarding in Gmail to your intake address, and Gmail sends copies of new messages there; the steps are in Gmail forwarding. Command Mail requests no Gmail scope for receiving. Signing in with Google requests only openid, email and profile according to the app code, which tells Command Mail who you are and nothing about your mailbox.

Your agent then gets permissions in Command Mail rather than in Google: mail:read, mail:draft, mail:send-approved, mail:send and mailboxes[12]. mail:draft saves drafts and never sends. On the consent page you can switch off any requested permission, mail:send starts switched off there, and according to the app code only a person in a browser session can approve a draft.

There are three limits we want to name. Forwarding is not syncing: whatever you or your agent sort in Command Mail does not change Gmail, and older mail only arrives through an import. mail:read reads every mailbox in your account and allows sorting within each mailbox's autonomy level; separate read access needs separate accounts. And the Free plan does not send; sending starts with Pro[12].

To send from your Gmail address, you set up one of two routes in Settings under Connections; according to the app code, an agent cannot do this. The first sends through Google's servers with a Google app password, which Command Mail keeps sealed (encrypted) and, according to the app code, uses only to sign in for sending over SMTP; the code contains no IMAP access. Google's help page does not describe app passwords as limited to sending[11]. The second route needs no password: mail leaves from a Command Mail address with your name, and replies come back to your Gmail address; a code sent to that address confirms it is yours.

08Connect Command Mail to your agent

You can connect Command Mail through MCP or its directory listings, and choose your agent’s permissions when connecting[12]:

  • MCP address: https://commandmail.app/mcp for Claude Code, Codex, Cursor and other clients with remote MCP; sign-in uses OAuth 2.1[12].
  • Plugin or connector: in ChatGPT as an official plugin from the plugin directory, in Claude as a community connector from the directory[12].
  • Permissions instead of full access: every permission can be switched off when connecting, sending without approval starts switched off, and an approved draft goes out only in exactly the version a person confirmed[12].

All permissions and autonomy levels are described in Permissions and autonomy.

09Review status

As of 2026-11-02. The pages from Google, OWASP, OpenAI and Anthropic were retrieved on that day; OpenAI's help page refuses automated requests with 403 and was read through a reader proxy. The statements about Command Mail rely on llms.txt and the app code at commit 60c8c3d (Sign in with Google, the OAuth consent page and its preselection, the draft approval route, sending routes for forwarded addresses). We did not walk through Google's consent screens ourselves for this page.

You can start for free and connect your agent with mail:read only at first.

Frequently asked questions

What does “Read, compose, send, and permanently delete all your email from Gmail” mean?

It is Google's description of the scope https://mail.google.com/, the broadest Gmail access an app can get. It covers everything you can do in your mailbox yourself, including deleting mail permanently without the trash. Google tells developers to request it only if their app must delete messages immediately and permanently.

Is read-only access enough for an agent that summarizes email?

Yes. Searching, reading and summarizing work with gmail.readonly, which Google describes as viewing your email messages and settings. OWASP uses this exact case as its example: a summarizing agent only needs to read, not to send or delete.

Can I untick single permissions on Google's consent screen?

Only whole scopes. In the regular granular consent flow, Google shows checkboxes for sign-in scopes combined with at least one non-sign-in scope, or for multiple non-sign-in scopes. Sign-in scopes alone, or one non-sign-in scope alone such as full access, offer no individual selection. Unticking never turns full access into read-only access.

How do I revoke an app's access to my Gmail?

Go to myaccount.google.com/linkedapps, select Access to your Google Account, pick the app, select See details, then Remove access and Confirm. The app can no longer access your account. For data it already copied, Google says you may need to ask the developer to delete it.

Does Command Mail need access to my Gmail account?

Not for receiving. Gmail forwards copies to your Command Mail intake address, and Command Mail requests no Gmail scope for that. To send from your Gmail address through Google's servers, you add a Google app password. Without one, mail leaves from a Command Mail address and replies come back to your Gmail address.

Sources

  1. Google for Developers: Choose Gmail API scopes developers.google.com, accessed
  2. Google for Developers: OAuth 2.0 Mechanism (IMAP, POP, SMTP) developers.google.com, accessed
  3. Google for Developers: How to handle granular permissions developers.google.com, accessed
  4. Google for Developers: Method users.messages.modify developers.google.com, accessed
  5. OWASP: LLM06:2025 Excessive Agency genai.owasp.org, accessed
  6. OpenAI: Google app data controls FAQ (direct fetch 403, read through a reader proxy) help.openai.com, accessed
  7. Anthropic: Use Google Workspace connectors support.claude.com, accessed
  8. Google for Developers: Configure the Gmail MCP server (Developer Preview) developers.google.com, accessed
  9. Google Account Help: Manage links between your Google Account and apps from other developers support.google.com, accessed
  10. Google Account Help: Share some access to your Google Account data with apps from other developers support.google.com, accessed
  11. Google Account Help: Sign in with app passwords support.google.com, accessed
  12. Command Mail: llms.txt commandmail.app, accessed
EN
DE