A Gmail API scope is an OAuth permission setting that defines exactly what an app can do with a user’s mailbox. A scope may allow only basic profile or metadata access, or it may permit reading, composing, modifying, or sending email. Scopes are the main boundary that controls how much power a connected application receives.
In cyber security, scope matters because it limits the blast radius of a compromised app, malicious plugin, or prompt-injected AI agent. If a connector has a broad Gmail scope, an attacker who steers the app can potentially exfiltrate messages, alter mail, or send messages on the user’s behalf. Defenders reduce risk by choosing the narrowest practical scope, reviewing OAuth consent carefully, logging Gmail API activity, and requiring explicit approval before sensitive mail actions.