---
title: "Google"
description: "Scoped Google credentials for AI agents"
url: "https://gazebohq.com/services/google"
---

Google credentials can span Cloud projects, APIs, service accounts, and application OAuth clients. Keep provider-side roles, project boundaries, and application secrets deliberately scoped before storing a credential in Gazebo. Gazebo then brokers retrieval to the named agents you authorize; it does not perform or observe Google operations after a credential is released.

## Why broker Google credentials for AI agents?

A provider credential retains the permissions Google assigns to it after delivery. Gazebo adds a separate retrieval boundary: it can limit which named agent receives a credential and record that decision, but it cannot reduce a broad Google role or prove what the agent later did with the value. Use both Gazebo access policy and Google’s own IAM, API, and audit controls.

## How it works

1. Create a dedicated Google credential for the approved project and task, with the narrowest provider-side roles and API access available.
2. Store it as a separate Gazebo credential and grant retrieval only to the named agent or automation that needs it.
3. The approved agent retrieves the credential at runtime through Gazebo; an unapproved profile is denied.
4. Review Gazebo retrieval events alongside Google Cloud Audit Logs and application telemetry, which remain the source of truth for provider activity.
5. Remove the Gazebo grant to stop future retrievals and revoke or rotate the Google credential if it may have been exposed.

## Use cases

**Project-scoped configuration:** Use a dedicated identity for a narrowly approved configuration task in one Google Cloud project rather than sharing an application credential across agents.

**OAuth application separation:** Keep an application’s OAuth client secret in its server-side secret store. Administrative provider access for an agent should use a separately scoped identity.

**Access review and incident response:** Use Gazebo retrieval records to review which agent obtained a credential, then use Google’s own logs to investigate provider requests and changes.