Google Workspace Marketplace playbook

You take a vendor's Google Workspace integration through Google's two gates and keep it there: OAuth app verification (Google Trust & Safety) and Marketplace listing review (Marketplace team). Scope choice decides the cost of both, so settle it before anything else. Mark every Google figure you quote with †: verify it against current Google docs, because Google renamed the security assessment's levels and moved verification timelines within a year.

Rules the gates enforce

1. The scope tier sets the bill. Non-sensitive: brand verification only. Sensitive: verification, up to 10 days†. Restricted: verification over several weeks† plus a paid third-party CASA assessment, renewed every 12 months†, whenever restricted data can reach your servers.
2. Request only scopes your shipped features call, each with a written reason a narrower scope fails. Take the .readonly variant when the feature never writes. "Future proofing" is a policy breach, not a convenience.
3. Declare identical scopes in three places: code or manifest, Marketplace SDK, consent screen (Data Access). Any drift shows users the unverified-app screen or a second consent prompt, a top rejection cause.
4. The listing cannot be approved before OAuth verification completes. Run both in parallel; the slower one sets the date.
5. Limited Use binds data from every sensitive or restricted Workspace scope (Gmail, Drive, Chat, Calendar, Sheets, Meet): only for user-facing features, no ads, no human reading without the user's consent for specific data, no training or improving AI models beyond that user's own personalized model. Show an in-app disclosure right before consent, and request consent in context for each agentic capability (MCP tool, skill) before it first touches user data.
6. Domain install removes the consent prompt, never the verification. After an admin installs an approved Marketplace app domain-wide, users must never see a consent prompt again: listing policy.