Which OAuth scopes does the Applane builder request?

The builder requests these scopes at sign-in. They are granted to your own OAuth client, never to an Applane client. Because the consent screen is Internal, no scope needs Google verification and no CASA assessment applies. See No Google app verification needed.

Google’s classification is shown so a reviewer can map it to policy.

Scope	Google’s class	What the builder does with it
openid, email	Non-sensitive	Sign the employee in and check that the account is a verified member of your Workspace domain. Any other account is rejected and its token revoked.
https://www.googleapis.com/auth/script.projects	Sensitive	Create the Apps Script project for each app and push its files. The project is a Drive file owned by the builder.
https://www.googleapis.com/auth/script.deployments	Sensitive	Create and update the web-app deployment that gives each app its URL, and repoint it for publish and kill-switch actions.
https://www.googleapis.com/auth/script.processes	Sensitive	Read-only execution history, so the builder can tell a builder that a scheduled run failed.
https://www.googleapis.com/auth/spreadsheets	Sensitive	Read sheet schemas while building, and let apps on the read-write tier write to sheets as the signed-in viewer.
https://www.googleapis.com/auth/drive.readonly	Restricted	List the apps shared with the builder and read the docs, slides and folders they point the agent at. Never writes.
https://www.googleapis.com/auth/cloud-platform	Sensitive	Call Vertex AI (Gemini) in your GCP project with the builder’s own identity, so usage is attributed and billed to you.

About cloud-platform

It is the broadest GCP scope, and reviewers ask about it. Three things bound it:

1. A token is only as powerful as its user’s IAM. A typical employee holds no GCP role beyond the roles/aiplatform.user grant Applane’s setup adds, so review the full predefined role before treating this as prediction-only access.
2. The client is Internal. The Google access token stays in browser memory and is sent to Google, never to Applane’s backend.
3. Generated app code runs in a sandbox that cannot reach the token.

A user’s other Google Cloud roles also apply to their token. Review builder access through your normal IAM process; the generated-app sandbox does not narrow the OAuth grant itself. See the IAM guide.

Scopes are fixed per build

The list is decided by the builder build, not per company. Turning the external or anonymous audiences off in Settings hides those features; it does not change the consent screen.

Revoking

A Workspace admin sees the grant per user under Security > API controls > Manage third-party app access, under your app’s name, and can revoke it there. A user can do the same at myaccount.google.com/permissions. Either signs them out of the builder.