Google Workspace Connection

The Google Workspace connection allows your Horizon agents to interact with Gmail, Google Calendar, Google Drive, and Google Sheets on behalf of your organization.

Prerequisites

Before connecting Google Workspace to Horizon, ensure you have:

• A Google Workspace account (Business Starter, Business Standard, Business Plus, or Enterprise).
• Admin access to your Google Workspace domain, or the ability to approve third-party app access.
• If your organization has strict third-party app policies, you may need a Google Workspace admin to allowlist Horizon in the Admin Console > Security > API Controls.

Setting Up the Connection

1. Navigate to Workspace > Connections and click + Add Connection.
2. Select Google Workspace from the integration list.
3. Click Sign in with Google. You will be redirected to Google’s OAuth consent screen.
4. Select the Google account associated with your organization.
5. Review the permissions Horizon is requesting and click Allow.
6. You will be redirected back to Horizon with the status set to Connected.

Note

If your Google Workspace admin has restricted third-party app access, you may see a “This app is blocked” error. Ask your admin to add Horizon to the list of trusted applications in the Google Admin Console.

Permissions and Scopes

Horizon requests scopes based on the Google services your agents need:

Gmail

• gmail.readonly — read email messages and metadata.
• gmail.send — send emails on behalf of the user.
• gmail.modify — modify message labels (archive, mark read/unread).

Calendar

• calendar.events — read and write calendar events.
• calendar.readonly — read-only access to calendar data.

Drive

• drive.readonly — read files and folder structure.
• drive.file — create and manage files that Horizon creates.

Sheets

• spreadsheets — read and write data in Google Sheets.

You can choose which services to enable during the connection setup. Disabling a service removes its scopes from the authorization request.

What Agents Can Do

With the Google Workspace connection, agents can:

• Read and send emails — search the inbox, read message content, compose and send replies or new emails.
• Manage calendar events — create meetings, check availability, update event details, and send invitations.
• Access Drive files — list files, read document content, and create new files or folders.
• Work with Sheets — read spreadsheet data, append rows, update cells, and create new spreadsheets.
• Search across services — find relevant emails, files, or events based on natural-language queries.

Tip

For security, consider connecting a service account instead of a personal account when you want agents to operate independently of any individual user’s mailbox or drive.

Domain-Wide Delegation (Optional)

For organizations that want agents to access data across multiple users without individual OAuth flows, you can configure domain-wide delegation:

1. Create a service account in the Google Cloud Console.
2. Enable domain-wide delegation for the service account.
3. In the Google Admin Console, authorize the service account’s client ID with the required scopes.
4. In Horizon, select Service Account as the authentication method and upload the JSON key file.

This approach is useful for agents that need to schedule meetings for different team members or send emails from shared mailboxes.

Troubleshooting

Issue	Resolution
”This app is blocked” during OAuth	Ask your Google Workspace admin to trust the Horizon app in Admin Console > Security > API Controls.
Cannot access another user’s calendar	Enable domain-wide delegation or have each user create their own connection.
Email sending fails	Verify the gmail.send scope is granted and the account does not have sending restrictions.
Drive files not visible	Ensure the files are owned by or shared with the connected account.

Disconnecting

To remove the Google Workspace connection, click Remove Connection in Horizon. You can also revoke access from your Google account at myaccount.google.com/permissions.