Connectors
Connect Google Calendar and Gmail — how consent works, and when your organisation needs to register its own Google application.
Connectors let the assistant act on your team's own systems — reading a calendar, drafting a reply — using each person's own account and their own permissions. Nobody sees anything through a connector that they could not see by signing in themselves.
What is available today
| Service | What it does |
|---|---|
| Google Calendar | Read events, create, change and cancel them |
| Gmail | Search and read mail, draft, send, reply, archive and bin |
Microsoft (Files, Mail) is registered but has no tools yet. SharePoint, BigQuery and other sources are planned.
Every change asks first
Anything a connector does that is visible outside the product — sending an email, inviting someone to a meeting, cancelling one — stops and asks the person for confirmation before it runs. The confirmation names the actual consequence: who is being emailed, how many of them are outside your organisation, which meeting is being cancelled.
Reads mostly do not ask, with one exception: an unusually broad read (six months of a calendar, a large slice of a mailbox) asks too, because pulling that much of someone's data into a conversation is worth a decision.
Drafting an email deliberately does not ask. A draft goes to the person's Gmail and is sent by them, so the draft is the review step.
Two ways to register the Google application
Consent always happens on Google's own screen, but whose application asks for it is your choice.
Ours, by default
Nothing to set up. Your users can connect Google Calendar immediately, and their consent is granted to Asteria's registered application.
Your own — required for Gmail
Your organisation registers its own Google Cloud OAuth application, and every consent in your organisation goes through it instead of ours. Three reasons to do this:
- Gmail requires it. Google classes mailbox access as a restricted scope, which on a public application needs an annual third-party security assessment. Registering your own application with an Internal consent screen — available to any Google Workspace organisation — removes that requirement entirely, because the application belongs to you and is only usable by your own people. Asteria refuses to request Gmail access through its own application, rather than failing on Google's screen after the fact.
- Central revocation. Access appears in your own Google admin console, and you can withdraw it there without asking us.
- Independence. If our application were ever rate-limited or suspended, yours is unaffected.
Set the consent screen to Internal, not Testing
A Google consent screen left in Testing issues tokens that stop working after seven days regardless of use. Every connection made against it will silently break a week later. Publish the screen as Internal before anyone connects.
Registering your own application
You will need a Google Cloud project owned by your Workspace organisation, and the Asteria administrator role.
- In the Google Cloud console, create a project. Check that its Location is your Workspace organisation and not "No organization" — the Internal option is unavailable otherwise, and a project cannot easily be moved afterwards.
- Under APIs & Services → Library, enable the Google Calendar API and the Gmail API.
- Under APIs & Services → OAuth consent screen, choose Internal and complete the application details.
- Under Credentials, create an OAuth client ID of type Web application. Add the redirect URI your Asteria administrator gives you, exactly as written.
- In Asteria, go to Platform → Connectors and enter the client ID and client secret.
From that point every new connection in your organisation uses your application. Existing connections keep working and move across the next time each person reconnects.
What your users do
Each person connects their own account under Profile → Connections, and chooses which services to include — Calendar, Gmail, or both.
Permissions cannot be added to an existing connection
Google grants permissions once, at the moment of consent. If someone connected Calendar only and later needs Gmail, they must reconnect and tick both — the Connections page offers exactly that, and says which services are missing.
Connections can be withdrawn at any time, from the Connections page or from the person's own Google account permissions.
What is recorded
Every approval decision — approved, denied, or timed out — is written to the audit log with the tool, the account it would have acted as, and who decided. The confirmation text itself, which names real recipients, is deliberately not stored.