Which accounts and groups does Applane use?

Who

Google Workspace admin

Time

5 minutes

Create these once in the Google Admin console. Two go into the Applane console; one goes into the GCP IAM grant.

Identity	Type	What it is for
applane-builders@<YOUR_DOMAIN>	Google Group	Who may build. It gets roles/aiplatform.user on the GCP project, so joining the group is the whole onboarding for a new builder. People who only open finished apps never need it.
applane-admins@<YOUR_DOMAIN>	Google Group	Made editor on every published app by rule. Members see the organisation’s app inventory in the extension and can take over or repoint any app. Put IT or the platform team in it.
applane-bot@<YOUR_DOMAIN>	User account (needs a Workspace licence)	Publishes partner-facing and public apps, so those apps run as the bot rather than as a person who may leave. Internal-only apps never use it.

The names are conventions, not requirements. Use whatever fits your naming policy and paste the real addresses into the Applane console.

Create the groups

1. Directory > Groups > Create group.
2. Name and email as above. Access type: Team or Restricted; the group needs no external members.
3. Add the first builders to applane-builders@. Add IT to applane-admins@.

Group membership changes reach the GCP IAM grant within a few minutes.

Create the bot account

1. Directory > Users > Add new user. Name it something obvious, for example “Applane bot”.
2. Assign a Workspace licence (it needs Drive and Apps Script).
3. Add it to applane-admins@ so it can edit every published app.
4. Store its credentials the way you store other service logins. It is used from a browser session by whoever publishes external or public apps, not by Applane’s backend.

Skip this account if you will never allow external or anonymous audiences. The Applane admin can turn those audiences off in Settings.

Hand over

Give the Applane admin the three addresses. They go into the setup checklist (bot account, admin group) and the GCP admin uses the builders group in IAM.