Grok Bot + Google Workspace

How a Bot connects

OAuth as a Bot Google user, allowlisted by the admin for the Bot OU. See the consent fix.

The Bot's identity

ops-bot@yourdomain in a dedicated OU; shared inboxes delegated; specific Drive folders shared. Don't reuse a human's login. If you did, see shared computer cleanup.

Routines we've run

• Daily — shared inbox triage (support@, invoices@): label, summarise, draft replies for approval
• Daily — calendar prep: for each meeting today, assemble a one-page brief from Drive and CRM
• Weekly — Drive folder hygiene for a named folder tree

Each routine follows the four-part shape: when it runs, what it reads (bounded), what it produces, when it stops. See routines best practices.

The thing to gate

Sending from a human's address, and Drive-wide access. Bot user, narrow shares, send with approval.

Verdict

The foundation for most setups. Do the OU and allowlist work once and every later integration is easier.

Setup notes

• Test every routine supervised until it's produced the right output three times.
• Add the routine's completion line to your heartbeat log so silent failures show up.
• Put the Google Workspace token in the Bot's connector settings or knowledge file, never in a chat message.