Type: Connector disposition
Subject: Google Calendar
Decision requested: Approve the proposed disposition for Google Calendar across its 8 assessed actions
Inherent / residual: High / Moderate
Control owner: Claude Owner / Primary Owner
Context: 8 assessed actions. Runtime settings proposed: Always Allow x4, Needs Approval x3, Blocked x1. Proposed for Blocked: delete_event. Class: Remote MCP server (first-party, vendor-hosted). Control point: Claude tool permission (Customize > Connectors; org-wide by Owner/Primary Owner). Control owner: Claude Owner / Primary Owner.
Risks: R-01 [High inherent / Moderate residual] Indirect prompt injection via externally-authored calendar content | R-05 [Critical inherent / High residual] Chained exfiltration: Drive read to Calendar outbound write | R-06 [Moderate inherent / Moderate residual] Attribution gap between agent-performed and user-performed actions | R-12 [High inherent / Low residual] Irreversible deletion with outbound cancellation notice | R-13 [Moderate inherent / Low residual] Free/busy disclosure of third parties including external attendees | R-27 [Critical inherent / High residual] Aggregate outbound surface across the estate
Open verification: V-07 [High] Whether the create, update, delete and RSVP tools are actually present in the connector, resolving the conflict between the vendor's documentation site and its knowledge base.
Ruling:
Amendment or condition: