Type: Connector disposition
Subject: Google Mail (Gmail)
Decision requested: Approve the proposed disposition for Google Mail (Gmail) across its 9 assessed actions
Inherent / residual: High / Moderate
Control owner: Claude Owner / Primary Owner
Context: 9 assessed actions. Runtime settings proposed: Always Allow x6, Needs Approval x2, Blocked x1. Proposed for Blocked: send_email - NOT EXPOSED as a tool (scope appears on consent screen). Class: Remote MCP server (first-party, vendor-hosted). Control point: Claude tool permission (Customize > Connectors; org-wide by Owner/Primary Owner). Control owner: Claude Owner / Primary Owner.
Risks: R-16 [High inherent / Moderate residual] Email-borne indirect prompt injection | R-17 [High inherent / High residual] Gmail send scope surfaced at consent while the capability is not exposed | R-27 [Critical inherent / High residual] Aggregate outbound surface across the estate
Open verification: V-06 [High] The OAuth scopes actually granted to the Claude application - specifically whether gmail.send is present despite the vendor stating send is not exposed.
Ruling:
Amendment or condition: