Which OAuth scopes does the Applane extension request?

The extension requests these scopes at sign-in. They are granted to your own OAuth client, never to an Applane client. Because the consent screen is Internal, no scope needs Google verification and no CASA assessment applies. See No Google app verification needed.

Google’s classification is shown so a reviewer can map it to policy.

Scope	Google’s class	What the extension does with it
openid, email	Non-sensitive	Sign the employee in and check that the account is a verified member of your Workspace domain. Any other account is rejected and its token revoked.
https://www.googleapis.com/auth/script.projects	Sensitive	Create the Apps Script project for each app and push its files. The project is a Drive file owned by the builder.
https://www.googleapis.com/auth/script.deployments	Sensitive	Create and update the web-app deployment that gives each app its URL, and repoint it for publish and kill-switch actions.
https://www.googleapis.com/auth/script.processes	Sensitive	Read-only execution history, so the extension can tell a builder that a scheduled run failed.
https://www.googleapis.com/auth/spreadsheets	Sensitive	Read sheet schemas while building, and let apps on the read-write tier write to sheets as the signed-in viewer.
https://www.googleapis.com/auth/drive.readonly	Restricted	List the apps shared with the builder and read the docs, slides and folders they point the agent at. Never writes.
https://www.googleapis.com/auth/cloud-platform	Sensitive	Call Vertex AI (Gemini) in your GCP project with the builder’s own identity, so usage is attributed and billed to you.

About cloud-platform

It is the broadest GCP scope, and reviewers ask about it. Three things bound it:

1. A token is only as powerful as its user’s IAM. A typical employee holds no GCP role beyond the roles/aiplatform.user grant Applane’s setup adds, so the scope unlocks Vertex calls and nothing else for them.
2. The client is Internal and the token never leaves Chrome’s identity plumbing; it is not sent to Applane.
3. Generated app code runs in a sandbox that cannot reach the token.

Engineers who do hold real GCP roles should know the extension could act with them; the sandbox is the mitigation.

Scopes are fixed per build

The list is decided by the extension build, not per company. Turning the external or anonymous audiences off in Settings hides those features; it does not change the consent screen.

Revoking

A Workspace admin sees the grant per user under Security > API controls > Manage third-party app access, under your app’s name, and can revoke it there. A user can do the same at myaccount.google.com/permissions. Either signs them out of the extension.