Google Workspace integration
Google Workspace changes,
recorded and verifiable.
Governax records access changes from Google Workspace into a tamper-evident ledger: user lifecycle, group membership, organisational units, admin roles, 2-step verification changes and third-party app grants. It polls the admin audit log every 10 minutes through read-only domain-wide delegation, and appends each change to a per-entity, SHA-256 hash-chained record.
What lands in the ledger
What does Governax record from Google Workspace?
User lifecycle
Users created, deleted, restored, suspended and unsuspended.
Groups
Members added and removed, member role changes, and groups created and deleted.
Organisational units
Users moved between units, and units created, deleted, renamed and moved.
Administrative privilege
Admin roles granted and revoked.
Authentication posture
2-step verification disabled or its enforcement changed, and password changes.
Third-party access
OAuth apps trusted and untrusted, and third-party app access granted and revoked.
Not captured: Settings toggles and usage events are not captured. Governax also excludes its own OAuth grant, so connecting does not log Governax into your ledger.
How does the Google Workspace connection work?
A super administrator authorises the Governax client id under domain-wide delegation in the Google Admin console, with four scopes that all end in .readonly: the admin audit log, users, groups and administrative roles. You then enter your primary domain and a super admin address in that domain for Governax to read as.
Governax polls every 10 minutes. The first poll backfills the previous 7 days, and each later poll re-scans a 24-hour trailing window, because Google's audit log can surface an activity well after it happened. A change can take fifteen minutes or more to appear.
Disconnecting stops the polling but leaves the delegation in place. To revoke fully, remove the client id from domain-wide delegation in the Admin console.
The baseline snapshot on connect
When you connect, Governax records an access.baseline_observed event for every active user, using the read-only directory user scope, so the ledger starts from who already has an account.
Scope
What Governax does not do
Governax is a system of record, not a control plane. It records Google Workspace access changes after they have happened; it does not grant, revoke or block anything.
It cannot change your Workspace
All four delegated scopes are read-only. Governax reads the admin audit log and directory detail, and nothing else.
It does not revoke itself on disconnect
Disconnecting stops polling. Removing the delegation in the Admin console is the step that revokes access.
It does not block changes
Activity is read after it has happened. Governax records changes; it cannot prevent one.
How this helps with audits
When an auditor asks who had access in Google Workspace and when it changed, the answer is a filtered view of the ledger rather than a folder of screenshots. Approvals are recorded for access requests raised with /governax in Slack. Filters combine tool, event type, actor and a date range, and the date range matches when the change happened in Google Workspace, not when Governax recorded it.
Because a baseline snapshot is taken when you connect, the record starts from who already had access, not only from the changes that followed.
Every event is appended to the entity's SHA-256 hash chain, and database triggers reject every update and delete. Anyone given read access to the entity, an auditor included, can re-run verification, which recomputes every hash and checks every link.
Verification proves that what was recorded has not changed. It cannot prove that everything that happened was recorded. Governax records the evidence; it does not map it to controls, perform the audit or export reports.
Questions
Google Workspace integration FAQ
Does Governax need write access to Google Workspace?
No. All four domain-wide delegation scopes end in .readonly: the admin audit log, users, groups and administrative roles. Governax cannot change anything in your Workspace with them.
How often is Google Workspace polled?
Every 10 minutes. The first poll backfills the previous 7 days, and each later poll re-scans a 24-hour trailing window to catch late-arriving activity. A change can take fifteen minutes or more to appear, which is normal.
Why does Governax need an admin account to impersonate?
Domain-wide delegation reads the audit log as a named super admin in your domain. If that person leaves and their account is suspended, ingestion stops, so prefer a long-lived administrative account over an individual's personal one.
Does disconnecting revoke Governax's access?
No. Disconnecting stops the polling but leaves the domain-wide delegation in your Admin console. To revoke fully, remove the client id from domain-wide delegation as well.
Other integrations
- SlackWorkspace membership, channels, external sharing and access requests
- GitHubOrganisation, team and repository access, branch protection
- OktaUsers, groups, app assignments and admin roles
- AWSIAM users, roles and policies, read from CloudTrail
- Microsoft Entra IDDirectory roles, group membership and app consent
- GitLabGroup and project membership, tokens and deploy keys
Connect Google Workspace and start the record.
Read the Google Workspace setup guide, compare plans, or start free with one entity.