How Anchoris Integrates with Google Workspace
Why We Need Domain-Wide Delegation
Anchoris analyzes the documentation held in your Google Shared Drives to report on content health: duplicates, conflicting information, stale documents, and actual usage.
Because Anchoris runs as a scheduled background process to build governance reports, it requires read access to your Shared Drives even when users are not actively logged in. In Google's security model, this requires a service account with Domain-Wide Delegation (DWD).
We designed this integration with strict least-privilege principles. Anchoris operates entirely read-only, polls incrementally to stay well within Google's per-project API quotas, and is explicitly restricted from accessing services like Gmail or Calendar.
Required OAuth Scopes
Below are the exact scopes Anchoris requests and the specific reason each is needed.
| Scope | Why Anchoris needs it |
| https://www.googleapis.com/auth/drive.readonly | To list files in your selected Shared Drives, read their metadata/permissions, and export text for analysis. Includes Docs, Sheets, and Slides. |
| https://www.googleapis.com/auth/admin.directory.group.readonly | To translate group sharing permissions (e.g., "shared with engineering@") into an accurate number of affected people for impact scoring. |
| https://www.googleapis.com/auth/admin.directory.user.readonly | To see which accounts are suspended or archived, allowing Anchoris to flag content owned by users who have left the organization. |
| https://www.googleapis.com/auth/admin.reports.audit.readonly | To read Drive view events from your audit log. This allows Anchoris to prioritize document fixes based on real readership rather than theoretical reach. |
Complete Inventory of Google API Calls
To assist with your security review, every Google API method called by Anchoris is detailed below. Every call is a read operation, except for establishing standard Drive change notifications.
Drive, Docs, Sheets, and Slides APIs
- drive.drives.list / drive.drives.get: To present Shared Drives for admin selection and read drive metadata.
- drive.files.list / drive.files.get: To enumerate documents and download native Markdown files.
- drive.files.export: To extract text from Google Docs as Markdown and from other binary file formats such as text/markdown and other future formats such as pdfs.
- drive.permissions.list: To read access control lists at both the drive and file levels for impact scoring.
- drive.changes.getStartPageToken / drive.changes.list: To pick up incremental edits rather than re-reading everything.
- sheets.spreadsheets.get: Retrieves spreadsheet titles, tab names, and displayed cell values (ignores formulas/formatting).
- slides.presentations.get: Retrieves slide titles, text, and speaker notes (ignores images/embedded media).
Admin SDK Directory & Reports APIs
- admin.directory.users.list: Retrieves basic user fields (ID, email, name, aliases, suspended/archived flags) to detect departed owners. Runs daily.
- admin.directory.groups.list / admin.directory.members.list: Retrieves groups and their direct members for readership impact scoring. Runs hourly.
- reports.activities.list: Retrieves Drive view events from the rolling 48-hour audit window to gauge actual document readership.
1.4 Security Boundaries
This grant is heavily constrained by design.
- Anchoris cannot modify anything: Every scope requested is read-only. Anchoris cannot create, edit, move, delete, or change permissions on any file, group, or user.
- Anchoris Cannot access email or calendars: Anchoris has no access to Gmail, Calendar, Chat, or Meet. The product contains no client libraries capable of reaching them.
Setting up Google Workspace for Anchoris
Configuration Checklist
- Obtain the Client ID: 115864122522626451908 (workspace-connector@anchoris-workspace-app.iam.gserviceaccount.com)
- Designate an account for Anchoris: Decide which Workspace account will act as the sync account.
- You will use the same account to login to Anchoris and set up the sync.
- The account must have certain permissions as described in the next section below. A super admin account will work but we recommend either creating a separate sync account for Anchoris and assigning it the right permissions, or assigning the permission to another human account that will be used for configuring Anchoris.
- Configure Delegation:
- Navigate to Google Admin console → Security → Access and data control → API controls → Domain-wide delegation.
- Click Add new.
- Enter the Anchoris Client ID.
- Copy and paste the following exact comma-separated list into the OAuth scopes field:
https://www.googleapis.com/auth/drive.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.reports.audit.readonly
- Note: It may take a few minutes for the configuration made in Google Workspace to start taking effect. We recommend waiting about 10-15 mins.
- Complete Setup in Anchoris: Sign in to Anchoris as the designated sync account and follow the onboarding setup wizard. Anchoris will verify the delegation with a single minimal read. If onboarding is configured by another admin already, you can go to settings and change the “owner” to set a new sync account.
- Select Drives: Choose the specific Shared Drives Anchoris is allowed to analyze. You can update this selection at any time from settings.
Permissions needed for Anchoris sync account
| Privilege | Admin console path | Why Anchoris needs it |
| Drive and Docs | Privileges → Services → Drive and Docs | Google requires a Drive and Docs administrator privilege to use useDomainAdminAccess, which is how Anchoris lists the Shared Drives in your domain and reads drive-level sharing so your admin can choose what is in scope |
| Users → Read | Privileges → Admin API privileges → Users → Read | Read the user directory to detect suspended and archived accounts (departed document owners) |
| Groups → Read | Privileges → Admin API privileges → Groups → Read | Read groups and their membership, so "shared with engineering group" resolves to a number of affected people |
| Reports | Privileges → Reports | Retrieve Drive view audit events for the usage signal |
To assign these permissions to an account, you need to create a new Admin role (e.g. Anchoris Sync) by going to Accounts → Admin Roles in Google Workspace admin portal. Then you can assign this role to any user that you plan to use as the main user for Anchoris connection with Google Workspace.
2.2 Independent Verification & Revocation
You can independently verify Anchoris’ API usage behavior in your own Google Workspace audit logs at any time.
- Verify in your OAuth Log: Navigate to Admin console → Reporting → Audit and investigation → OAuth log. Filter by the Anchoris Client ID to see exactly which users are being impersonated and which scopes are requested.
- Verify in your Drive Audit Log: Filter by the impersonated accounts to confirm that all accesses are restricted to the selected Shared Drives and that absolutely no modification events (edit, trash, change_acl, etc.) occur.
Unilateral Revocation
You maintain absolute control. If you delete the Client ID entry in your Google Workspace Admin console (Security → Access and Data Controls → API controls → Manage Domain Wide Delegated Access), all Anchoris access is instantly and permanently revoked without requiring any action from Happeo/Anchoris.