Google Agentic OAuth Setting: What AI Agent Builders Must Change

On October 12, 2026, an email from the Google Workspace team landed in our own inbox with the subject line "Mark AI agent OAuth clients as agentic for Google Workspace MCP by Nov 11, 2026." Google's new Google Agentic OAuth Setting identifies OAuth clients used by AI agents that interact with Workspace services. Four of our Google Cloud projects were on the affected list. If you build anything that lets an AI agent read Gmail, search Drive or book Calendar slots, you probably got the same email, or you will hear about it the hard way when your agent starts getting refused.

We build CRM integrations, Google Apps Scripts and MCP servers for a living, so we went through the email line by line and checked it against Google's own documentation. Here is what is actually changing, who needs to act, and the exact steps we are following on our own projects.

The Short Version

If your app is an AI agent that will talk to Google Workspace through the new MCP servers, you need to act on it before November 11, 2026. Here’s the short version:

• What: The Google Agentic OAuth Setting adds an is_agentic flag to OAuth clients in the Google Cloud console.

• Why: Google is launching Workspace MCP (Model Context Protocol) servers for Gmail, Drive, Calendar, Docs, Sheets, Slides, Chat and People. Only OAuth clients marked as agentic will be allowed to call them.

• Deadline: From November 11, 2026, requests from non-agentic clients to Workspace MCP servers are rejected.

• The Catch: From November 12, 2026, the setting is locked on existing clients. Miss the window and you must create a brand-new OAuth client ID and ship it to your app.

• Not Affected: Regular apps that only call Workspace REST APIs (Gmail API, Drive API and so on) and are not AI agents.

The Three Dates That Matter

Why Google Is Doing This

Until now, Google saw an AI agent and a normal SaaS app the same way: both were just OAuth clients holding a token. That stops working once agents can act across a user's mailbox, files and calendar on their own. Separating the two lets Google and Workspace admins treat agent traffic differently. The email says agentic clients will get "separate security controls applied, such as agent access controls", which in practice means admins will be able to allow or block AI agents without breaking the rest of their integrations. With the Google Agentic OAuth Setting, Workspace administrators can distinguish AI agent traffic from regular application traffic and apply relevant agent-specific controls.

Google's Cloud help page is careful about what the flag is not. Ticking the box is a self-declaration. It grants no extra scopes and no extra access to user data, and agentic clients still need user consent and OAuth app verification like any other app. Our read: this is the same move every platform made once agents became real users. Labelling agent traffic now is cheaper for Google than untangling it later, and it gives Workspace admins the switch they have been asking for.

Are You Affected? A Quick Check

Here’s what to do before the deadline, depending on which case describes your OAuth client:

1. Your OAuth client is used by an AI agent (an LLM that calls tools, a Claude or Gemini connector, a custom MCP client, an n8n or Apps Script agent that decides what to do on its own). Mark it agentic. Google says this applies even if the agent only uses Workspace REST APIs today.

2. Your OAuth client powers a normal app (a CRM sync, a mail merge, a backup tool) with no AI agent making decisions. Leave it alone. Do not tick the box just to be safe, because agentic clients will fall under agent-specific admin controls.

3. One client does both. Split it. Google's guidance is to keep a standard client for interactive sessions and direct API calls, and a separate agentic client used only for AI agents, automated tool execution and MCP.

Also Read: Google’s 28th Birthday Brings an AI Mode Quiz

How to Mark an OAuth Client as Agentic

To configure the Google Agentic OAuth Setting, open the Google Cloud project that contains the OAuth client used by your AI agent.

1. Open the Google Cloud console and pick the project that owns your agent's OAuth client.

2. Go to Google Auth Platform › Clients (the older path is APIs & Services › Credentials).

3. Open the OAuth 2.0 client ID your agent uses, or click Create client for a new one.

4. Tick "Use this client for an AI-powered agent" and save.

5. If the same client also serves non-agent traffic, create a new agentic client instead, update your agent's client ID and secret, and keep the old client for the rest of the app.

6. Repeat for every project that Google listed in its email. Do it before November 11, and certainly before the setting locks on November 12.

What We Are Doing at OutRightCRM

We split our own clients into two groups. The ones behind our Gmail-to-CRM lead capture, Apps Script automations and SuiteCRM add-ons are classic API integrations, so they stay non-agentic. The ones we use to test AI agents against Gmail, Drive and Calendar are being marked agentic, and where a single client was doing both jobs we are creating a fresh agentic client rather than flipping the old one. The same thinking applies to CRM agents. If you connect an assistant such as Claude to your CRM through an MCP server and also let it read the customer's Gmail thread, the CRM side and the Workspace side are separate permissions. The Google Agentic OAuth Setting helps teams identify AI agent traffic, apply the right security controls, and keep standard integrations separate from agentic workflows as they connect Google Workspace with CRM systems.

FAQ

What does "agentic" mean for a Google OAuth client?

It is a self-declared flag (is_agentic) saying the client is used by an AI agent that takes actions or fetches context for users. In the console it shows as "Use this client for an AI-powered agent".

What happens if I miss the November 11 deadline?

Calls from your client to Workspace MCP servers fail with an error saying the client isn't marked as an AI agent. Until November 11 you can still tick the box on the existing client; from November 12 you need a new client ID.

Does marking a client agentic give it more access?

No. The Google Agentic OAuth Setting identifies an OAuth client as agentic; it does not grant additional scopes or data access.

My app uses the Gmail API but has no AI. Do I need to do anything?

No. Apps that are not AI agents and only call Workspace REST APIs are unaffected.