{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T02:40:06.177Z",
  "record_id": "VXI-EXT-PROCUREMENT-WORKSPACE-APP-SCOPES-01-v1",
  "record_kind": "external_reference",
  "title": "Workspace app controls: Trusted access is not a narrow scope grant",
  "system": "Google Workspace",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does marking a third-party app Trusted prove it has only the scopes needed for my task?",
  "near_questions": [
    "What does a Trusted Workspace app designation allow?",
    "How does Specific Google data differ from Trusted?",
    "Can Limited apps access restricted services?",
    "Which organisational unit receives an app setting?",
    "Does a configured app bypass unconfigured-app defaults?",
    "Which OAuth client ID is being approved?",
    "Can sign-in scopes differ from data scopes?",
    "Does an allowlisted device app override an API block?",
    "What evidence proves the actual grant?",
    "Can an app request more access than the task needs?",
    "When should a trust label require clarification?",
    "Can I preserve a Workspace app-scope review?"
  ],
  "supported_claims": [
    {
      "claim": "Trusted apps can access restricted and unrestricted Google services, subject to the relevant authorisation. The guide separately offers Specific Google data scope selection and organisational-unit settings. A Trusted label alone therefore does not establish a narrowly scoped integration.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Trusted apps can access restricted and unrestricted Google services, subject to the relevant authorisation. The guide separately offers Specific Google data scope selection and organisational-unit settings. A Trusted label alone therefore does not establish a narrowly scoped integration.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-ENTRA-CAE-01-v1",
    "VXI-EXT-PROCUREMENT-AWS-ROLE-CUTOFF-01-v1",
    "VXI-EXT-PROCUREMENT-GITHUB-APP-IDENTITY-01-v1",
    "VXI-EXT-PROCUREMENT-GITLAB-PAT-ROTATION-01-v1",
    "VXI-EXT-PROCUREMENT-SNOWFLAKE-SECONDARY-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Google Workspace third-party app access controls",
    "source_url": "https://support.google.com/a/answer/7281227?hl=en",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-WORKSPACE-APP-SCOPES-01-v1",
    "candidate_record_sha256": "c3e560a21b745f513a8c78ac725ff95fa9ad69caae122be7b04f47321f9898a1",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Trusted apps can access restricted and unrestricted Google services, subject to the relevant authorisation. The guide separately offers Specific Google data scope selection and organisational-unit settings. A Trusted label alone therefore does not establish a narrowly scoped integration.",
    "required_buyer_context": "Google Workspace: App client IDs, scopes, access levels and organisational-unit assignments; buyer configuration and operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "A Trusted app designation proves least-privilege access.",
    "documented_statement": {
      "status": "documented",
      "statement": "Trusted apps can access restricted and unrestricted Google services, subject to the relevant authorisation. The guide separately offers Specific Google data scope selection and organisational-unit settings. A Trusted label alone therefore does not establish a narrowly scoped integration.",
      "source_ids": [
        "workspace-apps"
      ]
    },
    "buyer_evidence_required": [
      "OAuth client identity and requested scopes.",
      "Configured app access level and organisational-unit scope.",
      "Evidence of actual granted access for the intended workflow."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require scope and organisational-unit evidence before accepting a least-privilege claim."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "workspace-apps",
        "url": "https://support.google.com/a/answer/7281227?hl=en",
        "final_url": "https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data?hl=en&visit_id=639277140535023147-3387326020&rd=1",
        "title": "Google Workspace third-party app access controls",
        "checked_on": "2026-10-16",
        "sha256": "85b039adecb4abf3cdc21e2150d2e3cb52992962fd7614e8c34b70cc474b891d",
        "bytes": 208257
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the concrete grant questions behind an app approval.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "App client IDs, scopes, access levels and organisational-unit assignments"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#workspace-third-party-scope-boundary",
  "machine_readable_record": "/varexis-index/records/workspace-third-party-scope-boundary.json"
}