IT Guide: AI Agent Workspace Accounts

How to provision a Google Workspace account for a SchoolClaude AI agent. Takes about 10 minutes. No domain-wide privileges are ever granted. ← Help Center

What you're setting up (and what you're not)

Each AI agent gets one ordinary Workspace account, exactly like a new employee. The SchoolClaude platform is then granted access to that single account only, via Google's standard OAuth consent — the same mechanism as "Sign in with Google" apps.

Security model: no domain-wide delegation, no service-account impersonation, no admin API access. The platform can act only as accounts that individually completed the consent step below, and you can revoke each one at any time from the Admin console.

Step 1 — Create the agent's account

  1. Admin console (admin.google.com) → Directory → Users → Add new user.
  2. Name it clearly as an agent, e.g. Nora (AI Agent), email like nora@yourdomain.org. Assign a license.
  3. Set a strong password and store it in your IT vault. Nobody will use it day-to-day — it exists for recovery and offboarding only.
  4. Recommended: place agent accounts in a dedicated OU (e.g. /AI Agents) so you can apply policies and find them easily.

Step 2 — One-time (per domain): trust the SchoolClaude app

  1. Admin console → Security → Access and data control → API controls → Manage third-party app access.
  2. Configure new app → search by client ID:
    1073514907771-f44kuqcg1c29naa3fgq37k6krfkl7e9n.apps.googleusercontent.com
  3. Select it, choose the scope of users (whole domain or the AI Agents OU), and set access to Trusted.

This only removes Google's "Google hasn't verified this app" warning during consent. It does not grant access to any account by itself — every account still has to consent individually in Step 3.

If you skip this step, the warning screen appears during consent. It is safe to proceed: click Advanced → Go to schoolclaude.com (unsafe) → continue to the normal consent screen. "Unverified" means the app hasn't gone through Google's public-app review — expected for a private platform.

Step 3 — Connect the account to its agent

  1. The SchoolClaude manager opens the agent's Manage panel, sets the work email to the new address, and clicks Generate connect link, then sends you the link.
  2. Open an incognito/private browser window and sign in to Google as the agent's account.
  3. Paste the connect link. Google shows a consent screen listing Gmail and Drive access for this account only. Click Allow.
  4. You'll see "Connected ✓". Sign out and close the window. Done — the password goes back in the vault and is never needed again.

The link expires after 1 hour and works once. If you consent with the wrong Google account, the platform rejects it and tells you.

Offboarding / revoking

  1. Revoke access only: Admin console → the agent user → Security → Connected applications → remove SchoolClaude. The agent instantly loses Gmail/Drive; its knowledge and chat history live in the platform and are unaffected.
  2. Full offboarding: suspend or delete the account, as with any departing employee.
  3. Note: changing the account's password also invalidates the connection (Google policy for Gmail access) — just redo Step 3 afterwards.

Where token prices come from

Cost figures in the dashboard are computed from token counts using a rate table, because Anthropic's API reports usage but publishes no pricing endpoint. The table lives in Firestore at config/pricing and is visible under Platform → Token pricing (platform admins only), so a price change is an edit rather than a code deploy.

  1. Weekly check. Every Monday morning a job reads Anthropic's official pricing pages and reconciles them against the stored table.
  2. What updates on its own: only a plain rate change, to a model already in the table, with a cited source, within a sane band. Everything else — a new model, a promotional price appearing or ending, an uncited or implausible figure — is held as a proposal for a human to accept or dismiss.
  3. Audit trail. Every run, automatic or manual, is written to the pricingChecks collection with the full before and after, so any change can be traced and reversed.
  4. Independent tripwire. Each task also compares our computed cost against Anthropic's own list_cost figure. A gap wider than the promotional discount is logged as pricing drift — that's the signal the table has gone stale.

You can also run the check on demand with Check for changes in the same panel. It takes a minute or two and costs a few cents.