# Gmail draft permissions

Google has no drafts-only OAuth scope.
[`gmail.compose`](https://developers.google.com/workspace/gmail/api/auth/scopes)
permits managing drafts **and sending email**. Do not invent a narrower grant.
Request `gmail.readonly` only if reading mail is also required.

Save a thin personal playbook that calls `users.drafts.create`, not
`messages.send` or `drafts.send`. Document and test that behavior. Use the
existing `integrationLock({ name, playbook_id })` to restrict which playbook may
use the connection; ad hoc execute and other playbooks are denied. Unlocking or
removing grants remains an owner action in integration settings.

This is an **identity-based integration grant**, not an immutable code grant.
Personal playbooks use current saved code and have no published revision lock.
Do not promise that a drafts-only export permanently removes send authority from
a token or from later edits. Editing must not automatically widen grants. If the
user requires an unchangeable no-send boundary, explain that this workflow alone
does not provide one; use a provider-side restriction or a separately controlled
service that enforces it.

Read current source and `edit_token` with `playbookGet`; save complete files
using `expected_edit_token`. Test only draft creation, with user consent for the
actual draft write. Keep schedules disabled until the intended behavior and
required approvals are verified.

See [Google setup](/guides/google),
[integration bootstrap](/guides/integration-bootstrap), and
[personal playbook authoring](/guides/playbook-authoring).