Connect Claude or ChatGPT to Gmail and Calendar and the setup screen makes it look like one decision: click Allow, sign in with Google, done. It is actually three or four separate decisions bundled into a single click -- which specific apps get access, whether each action that writes something needs your sign-off first, and whether your organization has already switched that sign-off off on your behalf. None of that shows up on the consent screen. Here's the workflow that keeps an agent useful for what you actually wanted -- drafting a reply, finding an open slot -- without quietly handing it more than that.
This isn't hypothetical. Gmail and Calendar connectors now live inside both companies' standard chat interface, not buried in a developer console -- and OpenAI's own connector lineup expanded again on August 28, 2026, adding support for multiple Google accounts in the same conversation. The capability arrived fast; the habits for using it safely haven't caught up at the same pace.
Two connectors that look like one
Both vendors build the connection the same basic way underneath. Gmail, Calendar, Drive, and (for ChatGPT) Contacts are separate connectors, not one Google switch -- Anthropic's own support documentation says Claude "only accesses your data when you explicitly ask a question or request an action requiring this information, and retrieves the minimum information needed," and each app toggles on its own. OpenAI's version works the same way: each Google identity is connected separately, so a user can add Calendar and leave the inbox out entirely, and since the August 28 update the same ChatGPT conversation can even hold two separate Google identities at once -- a work account and a personal one, kept apart rather than merged.
Two vendors, the same basic shape
| Claude Anthropic | ChatGPT OpenAI | |
|---|---|---|
| Gmail, Calendar, Drive connect as separate toggles | Yes | Yes |
| Sending an email asks for approval each time, by default | Yes | Yes -- Allow/Deny prompt |
| An admin can pre-approve actions so members aren't asked | Yes, on Team and Enterprise plans | Not documented in vendor help pages |
| Multiple Google accounts connected at once | Not documented either way | Yes, since Aug 28, 2026 |
| Gmail attachment content readable (not just metadata) | No -- metadata and file names only | Not documented in the same explicit terms |
That third row is worth sitting with. Anthropic states outright that Team and Enterprise plan owners can let their members skip the approval prompt entirely -- a setting an individual user might never see get flipped. OpenAI's own help pages don't spell out an equivalent override, but that's a gap in what's publicly documented, not proof the behavior can't exist. The honest move is to test your own account rather than assume either direction.
"Claude only accesses your data when you explicitly ask a question or request an action requiring this information, and retrieves the minimum information needed." -- Claude Help Center, on Google Workspace connectors
Sending is the one action worth treating differently from the rest. ChatGPT's send capability is restricted to paid plans and requires an explicit Allow on every single message. (It has also been geofenced out of the EU and UK entirely since mid-2026 -- connecting the account still works there, just not the send action itself.) A connector that's active is not the same thing as a connector that can act without you watching.
The workflow: connect, test, then trust
None of this is an argument against connecting an agent to your inbox -- it's an argument for doing it in an order that shows you what you actually granted before you find out the hard way. The underlying idea has a name security teams already use: least privilege, give access to only what the task in front of you needs, not what might be convenient six months from now. Five steps, about ten minutes:
Connect an AI agent to email and calendar without over-granting
- Calendar carries far less sensitive content than an inbox, and it's the easiest place to see whether the connector actually behaves the way its documentation says it will.
- Both vendors ask before an action that writes anything -- sending, deleting, creating an event -- by default. That's the setting doing its job.
- A read-then-suggest task exercises the connector's read access without touching anything that leaves your control if it goes wrong.
- Claude and ChatGPT both keep a record of what a connector actually read or wrote, separate from the summary shown in the chat.
- Sending is the one action with no undo. Once approval is switched off, it stays off for every message going forward, not just the ones you happened to be watching.
Step five points at the real question every team runs into eventually: should per-action approval ever come off? The honest answer depends on what the agent is actually doing, not on how much you trust it in the abstract.
Should you turn off per-action approval?
Whichever branch applies, notice that three of the four keep approval on. That's not caution for its own sake -- the failure mode here (an email that goes out, a meeting that gets moved) has no undo, so the bar to remove the one check that catches it should be a specific, reviewed task, not a general sense that things have been going fine.
Four ways this goes sideways
None of this asks for more trust in the agent -- it asks for the same habit you'd use handing a new hire their first set of keys: the smallest useful set first, a way to check what they actually did with it, and no illusion that taking the keys back undoes what's already been done.
- Gmail, Calendar, and Drive connect as separate switches, never one bundled Google toggle.
- Claude and ChatGPT both ask approval before sending an email or deleting a file, by default.
- Team and Enterprise admins can turn that approval step off without an individual user seeing it happen.
- Connect one low-stakes app first, then check the actual action log, not just the reply.
- Caveat: revoking access later doesn't unsend anything -- the approval prompt is the only real safety net.