For whoever asks the hard questions.
Written for the person a partner forwards this to. Everything here is checkable against the source, which you can inspect on request. If something below is wrong, I'd rather hear it from you than not hear it.
Who it acts as
Identity, authorisation and install.
- IdentityPer-user OAuth. There is no service account and no domain-wide delegation. Every call carries the signed-in user's own access token, so Workspace sharing, group membership and revocation apply unchanged. Acting on another user's behalf is not disabled, it is not expressible: the tools that would have allowed it were removed rather than switched off.
- AuthorisationThe OAuth client is an Internal application in the
client's own Google Cloud project. That is what allows a scope set including
gmail.sendand fulldrivewithout Google verification or an annual CASA Tier 2 assessment of a third party. - InstallA Cloud project in the client's own Workspace organisation, an administrator allowance where third-party access is restricted, and per-user consent. Every install is accepted by running a read and a write against every API as a real user before handover.
What it cannot do
The limits, and why they are limits.
- Deletion
https://mail.google.com/is deliberately not requested, so permanent deletion is unavailable to the process. No permanent-delete tool is exposed anywhere and the test suite asserts that none ever is. Messages and files go to the bin and are recoverable for thirty days. - EgressSharing outside the organisation requires an explicit argument on the call. Anyone-with-the-link sharing additionally requires an operator to change a configuration flag and restart the service, because a public link cannot be recalled once it has been copied.
- ConcurrencyDocs writes accept a required revision id, so a batch is refused rather than applied over the top of a colleague who had the document open.
Where it runs
Isolation, tokens and the record.
- IsolationOne container per client. No shared process and no shared storage, on a read-only root filesystem.
- TokensRefresh tokens are encrypted at rest with a key unique to the deployment, and are deliberately never backed up. Losing them costs each user a thirty-second reconnect; an offsite copy of live mail credentials is a liability with no matching upside.
- AuditOne structured line per tool call: identity, tool, read or write, outcome, and the opaque Google object id. Recipients, subject lines, bodies, document titles, file names and search queries are excluded by allowlist rather than denylist, so a field nobody has considered yet is private by default. The log stays on the deployment and is never shipped centrally.
- ProtocolMCP over HTTP with dynamic client registration, so the server is not tied to one vendor's client. Claude and Codex are the clients I install, test and support.
- ScopeSixteen OAuth scopes, covering mail, Drive, Docs, Sheets, Slides, Calendar, Contacts, the directory and Tasks. The full list is in the install runbook rather than paraphrased here, because a paraphrased scope list is worse than none. Users see all sixteen on the consent screen, which looks alarming and is correct: it is what lets the thing finish a job instead of handing it back.
- Against the native connectorsClaude's own Google connectors do Calendar in full and will upload files to Drive; the comparison on the home page leaves those rows out for that reason. Vorkane adds sending mail, editing documents and spreadsheets that already exist, granting and revoking file access, and Contacts and Tasks. The structural difference is position: every outside vendor's Workspace access exists at Google's discretion and can be narrowed or withdrawn, while Vorkane runs as the client's own Internal application in the client's own Cloud project, which is the position least exposed to a platform changing its mind about outsiders.
- SourceNot published publicly. Open for inspection on request, with the install runbook and longer answers to anything above.
Next
Ask me for the rest.
Anything not answered here has an answer. Tell me what you need and you'll get specifics rather than assurances.