Google Workspace Agent Inventory: Find every Gemini agent, script and grant

A Google Workspace domain now runs agents that no one listed: Workspace Studio flows acting with their creator's access, Gemini Enterprise agents reaching into Drive and Gmail, shared Gems and years of Apps Script bots with their own Cloud projects. Each lives in a different part of the Admin console or Google Cloud, and none of them appears in the user directory. This runbook builds one reconciled inventory from the Agents pages, the API controls app lists, the OAuth token audit, the Workspace Studio and Drive audit logs and the organisation's Apps Script Cloud folder. It covers read-only discovery first, then ownership, access reduction and removal with a rollback. It is for Google Workspace super administrators, Google Cloud organisation administrators and the security engineers who own AI governance. For the operating model behind a registry, see the AI agent registry guide.

This is an independent guide from NHI Mgmt Group, based on Google's public documentation as of November 2026. It is not sponsored or reviewed by Google. Agent features in Workspace are changing quickly, so confirm menu names, privileges and editions against Google's current documentation.

Key takeaways

• Five sources, one inventory. Agent access management, the API controls app lists, the token audit, the Workspace Studio and Drive audit logs and the Apps Script Cloud folder each see a different slice of the agent estate.
• The agent list is not complete by default. Google documents that the Gemini Enterprise management list shows only agents an administrator added manually; everything else follows the edition's default policy.
• Agents inherit people. A Studio flow has the same data access as its creator by default, and an Apps Script bot runs with the scopes its user authorised, so the owner record matters as much as the agent record.
• Apps Script leaves a Cloud footprint. Every script has a default Cloud project in the organisation's Apps Script folder, which gives you a countable list and a reliable way to stop a script.
• Reduce access before you delete. Pause data access, Change access and the Blocked level are reversible; deleting a script's standard Cloud project or a flow is not.

When you need this

• Before or just after enabling Workspace Studio: Google launched Studio to all Rapid Release and Scheduled Release domains by March 2026 as a core service, so many tenants received it under their release preference rather than a project decision.
• After a leaver wave: flows and scripts owned by departed staff keep their configuration, and standard Apps Script Cloud projects persist even after the script is deleted.
• For an audit or AI register request: NIST SP 800-53 CM-8 and NIST CSF 2.0 ID.AM-02 expect a maintained inventory of software and services. The AI Register and AI Inventory Template gives the record this inventory feeds.
• After an OAuth or AI app incident: you need to find every agent and app holding a given scope fast. A forgotten AI tool with a live token is a standing machine identity, so the inventory should already show its owner, scopes and last activity. The Shadow AI Discovery Guide covers how such tools are found across the wider estate.

Where agents show up in Google Workspace

Google groups agent controls under a top-level Agents menu in the Admin console, but older automation still lives under API controls, Drive and Google Cloud. Use each view for the question it answers.

Agent types and what to record

Before you start

• Privileges: build a custom discovery role with the Audit and investigation tool, Reports and read access to Security settings. Keep Security administrator, Service Settings administrator and Gemini Settings administrator rights for the change steps in a separate, approved group. On the Google Cloud side, grant resourcemanager.projects.list on the Apps Script folder only.
• Editions: the security investigation tool, which raises the export limit, is available on Enterprise Standard and Plus, Frontline Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium. The Apps Script external connection allowlist needs Business Plus, Enterprise or the listed Education editions.
• Timing: Google states that agent access and Studio setting changes can take up to 24 hours, so plan holds and verification around that.
• Record format: agree fields first: agent name, type, IDs (Flow ID, Agent ID or SPIFFE ID, OAuth client ID, script ID, Cloud project number), owner, OU, scopes or access level, external apps or URLs, sharing, last run or last token activity and decision.

Step-by-step

Steps 1 to 6 are read-only. Steps 7 and 8 change access but are reversible. Step 9 is destructive.

1. Export the agent access list. Open Menu > Agents > Agent access management. Filter by Type (for example Studio flow) and record every row with its access level. Then open Agents > Settings and record Default access for Workspace agents and Default access for Studio flows for each OU. The defaults matter most for Gemini Enterprise agents, because any agent not on the list follows the edition's policy, and the documented default for listed agents is Trusted.
2. Add known Gemini Enterprise agents by ID. Ask the Google Cloud team for the SPIFFE ID of each agent in Gemini Enterprise Agent Platform. Use Add agent, enter the ID and keep the access option at its current state for now, so that the list becomes a register without changing behaviour. The Gemini Enterprise Security Guide covers how those agents are built and governed on the Cloud side.
3. Download both app lists. In Security > Access and data control > API controls, open the app access list, then Download list for Configured apps and for Accessed apps. The configured CSV adds Number of users, Requested services and API scopes. Sort by users and by restricted services such as Gmail and Drive, and tag AI tools and assistants. Record the Unconfigured third-party apps setting and whether Trust internal apps is on, because that one setting trusts every organisation-owned app, including internal scripts, for restricted APIs. The third-party OAuth app inventory runbook goes deeper on this list.
4. Pull the token audit. Query the Reports API for 90 days to see which apps were granted scopes, by whom, and which actually call APIs:

   GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/token?eventName=authorize
   GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/token?eventName=activity

   Group authorize events by client_id and app_name and keep scope; group activity events by client_id, api_name and method_name, and sum num_response_bytes to spot heavy readers. request events with app_request_info show users asking for blocked apps, which is a good signal of shadow AI demand. For a single user, the Directory API users.tokens.list method returns their current grants.
5. Search Workspace Studio and Drive logs. In Reporting > Audit and investigation > Workspace Studio log events, widen the date range from the default 7 days and search Create flow, Edit flow, Turn on, Start run and Block step. Export Flow ID, Flow name, Actor, Step app and Agent product. A Step app value naming a third-party service (Studio connects to apps such as Jira, Asana and Salesforce) marks a flow that moves data out of Workspace. For full flow configurations, Google documents the Data Export tool, which includes flow setups and execution logs. Then open Drive log events, filter Document type to Google Script, and export to find standalone scripts, their owners and recent edits. Shared Gems are stored in Drive too, so check Drive sharing for them.
6. List Apps Script Cloud projects. In the Google Cloud console Manage Resources page, copy the ID of the Apps Script folder, then list its projects:

   gcloud projects list --filter='parent.id=APPS_SCRIPT_FOLDER_ID'

   Default projects carry the system service account [email protected] as owner. Standard projects were created deliberately, are required for Marketplace add-ons and the scripts.run API, and persist after the script is deleted, so treat each one as a managed asset with an owner. Use Reports > Apps Reports > Apps Script for daily active users and projects over six months, which shows whether the estate is growing. For scripts that hold service account keys or use domain-wide delegation, cross-check the domain-wide delegation grants audit.
7. Reconcile and assign owners (reversible). Join the sources on OAuth client ID, Agent ID, Flow ID and script ID. Classify each agent as approved, needs owner, needs review or remove. A flow, script or app whose owner is suspended or deleted needs a named successor before anything else changes. Record a sponsor for each Gemini Enterprise agent, and see Agent Identity Recertification for the review cycle.
8. Reduce access (reversible). For a Studio flow, work agent or Gemini Enterprise agent use Actions > Change access to Specific Google data or Blocked, or Pause data access. Know the effect per type: paused Studio flows keep running without Google data and users see errors in the Studio activity log; work agents stop in-progress tasks and their environment is deleted; Gemini Enterprise agents lose Google data but can still accept tasks. For OAuth apps, set Limited or Blocked in API controls; blocking overrides an allowlist entry for the same app. Hold this state for a full business cycle.
9. Remove (destructive). To stop an Apps Script project completely, Google documents deleting its Cloud project, which stops all executions and needs delete permission on the project. Revoke individual user grants with the Directory API users.tokens.delete method or the user's security page. Delete flows only after the hold period and owner sign-off, and export their configuration first so you can rebuild one if needed.

Verify it worked

• Counts reconcile: every client ID with token activity maps to a configured app, a script or a listed agent. Unmatched clients are your shadow agents.
• Owners exist: no flow, script or standard Cloud project in the inventory is owned by a suspended or deleted account.
• Blocks are real: Workspace Studio log events show Block step or no new Start run for paused flows, and token activity stops for blocked clients after the documented propagation window.
• No breakage: owners and the help desk report no failed business process during the hold.

Rollback and common errors

Common failure patterns

• Treating the agent list as the inventory: it only shows Gemini Enterprise agents you added. Use the token audit and the Cloud folder to find the rest.
• Leaving Trust internal apps on without a list: every internal script gains restricted API access with no individual review. Inventory internal apps first, then decide.
• Ignoring container-bound scripts: scripts inside Sheets and Forms are easy to miss in Drive searches; the Cloud folder and token audit still show them.
• Counting existence, not use: an agent with Trusted access and no runs is still a standing grant. Track last activity and reduce access for idle agents.
• Deleting first: a deleted flow or Cloud project removes the configuration you need if the agent turns out to be part of an incident. Export, pause, then delete.

Hardening afterwards

• Set safer defaults: use Specific Google data as the default for Workspace agents in OUs that handle sensitive data, and allow Studio only for groups that have an owner process.
• Restrict outbound reach: use the Apps Script external connection allowlist where your edition supports it, and the Studio step controls to allow or block service-specific and Gemini steps.
• Alert on change: configure Workspace Studio activity alerts and reporting rules on Create flow, token authorize events for unreviewed clients, and new projects in the Apps Script folder. The Google Workspace Audit Log Detection Guide covers rule design.
• Govern Gem sharing: keep Gem sharing on only where Drive external sharing rules are already tight. See the Gemini for Google Workspace Security Guide.

Small domain or large enterprise

A small domain can run steps 1, 3 and 5 from the Admin console each quarter and keep the inventory in a sheet, using the 100,000 row export limit. A large enterprise should script the Reports API token pull and the Cloud folder listing weekly into its CMDB or AI register, use the security investigation tool for large exports, and route new flows and scripts to OU owners automatically.

Metrics

Framework mapping

Practitioner checklist

• Create a read-only discovery role and keep change privileges in an approved group.
• Export Agent access management and record the default access settings per OU.
• Add every known Gemini Enterprise agent by SPIFFE ID.
• Download Configured apps and Accessed apps with scopes and user counts.
• Pull 90 days of token authorize and activity events and group by client ID.
• Export Workspace Studio log events and Drive log events for Google Script.
• List the Apps Script Cloud folder and give each standard project an owner.
• Reconcile, assign owners, reduce access and hold before any deletion.
• Schedule the token and Cloud folder pulls and alert on new flows and grants.

Standards and references

• Google Workspace Admin Help: Manage work agent access to Google data
• Google Workspace Admin Help: Manage Gemini Enterprise agents for Workspace users
• Google Workspace Admin Help: Control which third-party and internal apps access Google Workspace data
• Google for Developers: Reports API OAuth token audit activity events
• Google Workspace Admin Help: Workspace Studio log events
• Google for Developers: Monitor and control Apps Script use in your organisation
• Google for Developers: Google Cloud projects for Apps Script
• Google Workspace Admin Help: Turn Gem sharing on or off

Related NHI Mgmt Group resources: AI agent registry · Shadow AI Discovery Guide · How to Inventory third party oauth apps in google workspace · Google Workspace Security Guide · Gemini for Google Workspace Security Guide