Get started

Google Admin for AI agents

Google Admin is the console for managing Google Workspace users, groups, and organizational units. IT teams use it to provision and control company accounts. Connect it once through Arc0, and your agent, or Claude, ChatGPT and Cursor, can use it through one MCP endpoint, limited to what each user approved.

Connect Google AdminSee the 14 actions ↓
Security and identityOAuth 2.0MCP + RESTadmin.google.com
AUDIT LOG · GOOGLE ADMINPOLICY: acme-support
09:41:07 · claude · u_8f2read
google_admin.list_users
List Google Workspace Users✓ allowed · 212ms
09:41:08 · claude · u_8f2read
google_admin.get_user
Get Google Workspace User Details✓ allowed · 164ms
09:41:09 · claude · u_8f2write
google_admin.create_user
Create Google Workspace User✓ approved · approved by user
09:41:12 · claude · u_8f2destructive
google_admin.delete_user
Delete Google Workspace User✕ blocked · policy: deny
EVERY GOOGLE ADMIN CALL, ON THE RECORD
01 · USE CASES

What agents do in Google Admin.

01

Look up a user's account details

Check a Workspace user's account status and group memberships before troubleshooting access.

02

Add a user to a group

Add an employee to the correct distribution or security group after they join a team.

03

Suspend an account with approval

Suspend a departing employee's account only after IT confirms the offboarding request.

02 · ACTIONS

14 Google Admin actions, graded by risk.

Every Google Admin action is tagged read, write or destructive, so one policy covers the whole app and new actions inherit the right default.

read

5

Look things up. Allowed by default.

  • google_admin.get_user
    Get Google Workspace User Details
  • google_admin.get_group
    Get Google Workspace Group Details
  • google_admin.list_users
    List Google Workspace Users
  • google_admin.list_groups
    List Google Workspace Groups
  • google_admin.list_group_members
    List Google Workspace Group Members

write

5

Create and change things. Allow, or ask the user first.

  • google_admin.create_user
    Create Google Workspace User
  • google_admin.create_group
    Create Google Workspace Group
  • google_admin.add_user_alias
    Add Alias to Google Workspace User
  • google_admin.add_user_to_group
    Add User to Google Workspace Group
  • google_admin.update_group_settings
    Update Google Workspace Group Settings

destructive

4

Delete, cancel or archive. Ask first, or deny outright.

  • google_admin.delete_user
    Delete Google Workspace User
  • google_admin.remove_user_alias
    Remove Alias from Google Workspace User
  • google_admin.remove_user_from_group
    Remove User from Google Workspace Group
  • google_admin.suspend_user
    Suspend/Unsuspend Google Workspace User
03 · HOW IT WORKS

Google Admin in three steps.

  1. 01Your users connect Google AdminThey sign in to Google Admin on Arc0 Connect, under your brand, and approve the access you ask for.
  2. 02You set the rulesReads run, writes like “create Google Workspace User” can wait for the user, and “delete Google Workspace User” can be denied outright.
  3. 03Any agent can actYour agent calls Google Admin through the Arc0 SDK or MCP, and so can Claude, ChatGPT and Cursor. Every call lands on the audit log.
POLICY.TS
await arc0.policies.set('google_admin', {
  read: 'allow',
  write: 'ask',        // create_user
  destructive: 'deny',  // delete_user
})

# Claude Code: the same connection, one URL
$ claude mcp add --transport http arc0 \
    https://mcp.arc0.ai/u/u_8f2
04 · AUTH AND DATA

How Google Admin connects.

Users sign in to Google Admin on Arc0 Connect and approve the scopes you request. Build with Arc0’s Google Admin OAuth app, or bring your own so the Google Admin consent screen names you. Tokens refresh automatically, and you can export them whenever you want.

The same Google Admin connection serves your agent over MCP and your own backend over REST and the proxy, so a user connects once. How Arc0 handles credentials →

AUTH
OAuth 2.0
CREDENTIALS
Per-tenant encrypted vault
MODEL SEES
Results only, never credentials
AUDIT LOG
Every call, on every plan
05 · WORKS WITH

Use Google Admin from any agent.

Claude
ChatGPT
Cursor
Codex
VS Code
OpenAI Agents SDK
Claude Agent SDK
Vercel AI SDK
Mastra
LangGraph
06 · RELATED

More security and identity apps.

1Password6 actionsAbuseIPDB6 actionsAnonyflow5 actionsDnsfilter170 actionsBorneo153 actionsDigicert101 actionsParadym69 actionsPersona69 actions
ALL SECURITY AND IDENTITY APPS →
07 · FAQ

Google Admin and Arc0, answered.

Q01

Can I use Google Admin with Claude, ChatGPT or Cursor?

Yes. Connect Google Admin to Arc0 once, then add your Arc0 MCP URL to Claude, ChatGPT, Cursor, Claude Code or any other remote-MCP client. Each assistant only gets the Google Admin actions you allow.

Q02

How do users connect Google Admin?

Users sign in to Google Admin on Arc0 Connect and approve the scopes you request. Build with Arc0’s Google Admin OAuth app, or bring your own so the Google Admin consent screen names you. Tokens refresh automatically, and you can export them whenever you want.

Q03

Which Google Admin actions can my agent take?

14 in total: 5 read, 5 write and 4 destructive, such as “create Google Workspace User”. Your policies decide which of them each agent may call.

Q04

Can I stop my agent from deleting things in Google Admin?

Yes. Actions like “delete Google Workspace User” are graded destructive. Set destructive actions to deny, or to ask so the user approves each one, and blocked calls still show up on the audit log.

Q05

Can my own backend call Google Admin too?

Yes. The same Google Admin connection is available over REST and through the Arc0 proxy, so your product and your agent share one connection per user.

Get started

Plug Google Admin into your agent.

Your users connect Google Admin once, under your brand. Your agent gets 14 actions behind your policies, with every call on the record.

Connect Google AdminBrowse all apps →

Free to build · MCP + REST · Audit log on every plan