Which accounts and groups does Applane use?

Who

Google Workspace admin

Time

5 minutes

Create the builders and admin groups for your rollout. The Cloud admin uses the builders group for IAM; the Applane admin records the admin group and, when needed, the publishing bot account.

Identity	Type	What it is for
applane-builders@<YOUR_DOMAIN>	Google Group	Who may build. It gets roles/aiplatform.user on the GCP project, so members can call Gemini. They also need a seat under your Applane access policy and the one-time Apps Script API setting. People who only open finished apps never need it.
applane-admins@<YOUR_DOMAIN>	Google Group	Made editor on every published app by rule. Members see the organisation’s app inventory in the builder and can take over or repoint any app. Put IT or the platform team in it.
applane-bot@<YOUR_DOMAIN>	User account (needs a Workspace licence)	Publishes external and public apps, so those apps run as the bot rather than as a person who may leave. Internal-only apps never use it.

The names are conventions, not requirements. Use whatever fits your naming policy and paste the real addresses into the Applane console.

Create the groups

1. Directory > Groups > Create group.
2. Name and email as above. Access type: Team or Restricted; the group needs no external members.
3. Add the first builders to applane-builders@. Add IT to applane-admins@.

Group membership changes reach the GCP IAM grant within a few minutes.

Create the bot account

1. Directory > Users > Add new user. Name it something obvious, for example “Applane bot”.
2. Assign a Workspace licence (it needs Drive and Apps Script).
3. Add it to applane-admins@ so it can edit every published app.
4. Store its credentials the way you store other service logins. It is used from a browser session by whoever publishes external or public apps, not by Applane’s backend.

Skip this account if you will never allow external or anonymous audiences. The Applane admin can turn those audiences off in Settings.

Hand over

Give the Applane admin the three addresses. They go into the setup checklist (bot account, admin group) and the GCP admin uses the builders group in IAM.