
Those are some root level scopes there. I mean, imagine for a moment that Claude was convinced to call:
`POST googleapis.com/calendar/v3/ca…{calendarId}/clear`
No post body, a 204 response, and in a split second.. an empty primary calendar.
When we were going through Google app+security review for venn.ai (a safer way to connect your data to AI agents), we intentionally left out the massively destructive scopes. Not because we didn't think we could get approved, but because there's no valid reason to give anyone, or any AI, that much destructive capability.
English














