What You Grant
What happens when you press Allow.
Every other page on this site names the wall between your work life and your personal life. This one names the door. It covers what Google actually grants, and what that grant does and doesn't cover. It also covers how a message finds its way to one side of the wall, or waits for you.
The short version
Google grants Beemy two scopes for one whole account: read your mail, and send through it. That grant is the ceiling, not a promise anything happens. A separate autonomy rung, set one category at a time, is what actually turns sending on. And a message with no clear home waits for you; Beemy never guesses.
On this page
What Beemy asks Google for
Two scopes, and a ceiling on both.
Connecting Gmail requests exactly two OAuth scopes. This is the most Beemy is ever allowed to ask this account for. The registry that defines it calls this the least-privilege ceiling, and a real connection may hold no more than it lists.
Read your mail
https://www.googleapis.com/auth/gmail.readonly
Beemy can read message content and metadata. On its own, this scope lets Beemy see your mail and nothing else.
leastPrivilegeScopes · backend/src/connectors/registry.ts, CONNECTOR_REGISTRY["gmail"].leastPrivilegeScopes
Send through your account
https://www.googleapis.com/auth/gmail.send
Beemy can send a message through Gmail. The scope makes sending possible; a separate per-category grant is what actually turns it on.
leastPrivilegeScopes · backend/src/connectors/registry.ts, CONNECTOR_REGISTRY["gmail"].leastPrivilegeScopes
That registry lists every connector on Beemy's roadmap, and switches each one on or off. Gmail's is the only entry switched on today, so this page publishes Gmail's scopes and no others.
The three rungs
Three rungs, and none of them granted at connect.
read_only
Read only
Beemy reads and files. It drafts nothing and sends nothing. Every connected category starts here, and stays here until you move it.
autonomyLevel · backend/src/db/enums.ts, autonomyLevel
draft_only
Draft only
Beemy writes a reply in your voice and holds it for your approval. Nothing sends until you tap approve.
autonomyLevel · backend/src/db/enums.ts, autonomyLevel
auto_with_categories
Auto, one category at a time
Beemy sends without asking, but only for the one category you graduated to this rung. Every other category stays wherever you left it.
autonomyLevel · backend/src/db/enums.ts, autonomyLevel
Connecting an account grants no rung by itself. A category with no grant yet is read-only by default, and reaching draft or auto is a separate step you take later, one category at a time.autonomyGrants · backend/src/db/schema/autonomyGrants.ts, autonomyGrants
Why the grant is coarse, and the gate is not
One grant, one whole account. One gate, per category.
A Google grant covers your whole account, not one silo. Google has no notion of a silo to scope it to, so the scope actually held is recorded once, per connection.
scopes · backend/src/db/schema/connections.ts, connections.scopes
The autonomy rung is the fine control: one row per silo and per category, set independently of the account-level scope.
autonomyGrants · backend/src/db/schema/autonomyGrants.ts, autonomyGrants
Both have to hold before Beemy writes anything. A granted send scope, on its own, sends nothing anywhere; it only makes sending possible once a category's own gate says yes. See On Your Behalf for exactly what that gate allows and refuses.
How a message reaches one side of the wall
Staged first. Placed only once it's clear.
A message lands staged under your own intake key first. It has no silo yet, and no silo is guessed for it at this point.
inboundItems · backend/src/db/schema/inboundItems.ts, inboundItems
One test asks how sure the top match is. A second asks how far ahead it is of the next-best match. Both have to clear before Beemy commits it anywhere.
decide · backend/src/pipeline/pipeline.ts, decide()
A message that doesn't clear both bars waits for you. Beemy never guesses a silo to close the gap; you place it with one tap instead.
placeQuarantined · backend/src/pipeline/pipeline.ts, placeQuarantined()
Placing or correcting a message decrypts it under the old key and re-encrypts it under the destination silo's own key. A correction moves the content itself, not a label next to it.
commitToSilo · backend/src/pipeline/mover.ts, ReclassificationService.commitToSilo()
Your work account, and your employer
Connecting a work address isn't only your call.
See Your Work Account for who else decides, what a security reviewer will ask, and a summary you can send them.
A silo belongs to one person. The database allows exactly one silo of each kind per user, so there's no company column and no admin path into a personal silo.
silos_user_kind_unique · backend/src/db/schema/silos.ts, unique("silos_user_kind_unique")
Read Enterprise & Platform for the separate, admin-owned team-silo story that a Workspace deployment actually uses.
What to do next
If any of this changes your mind.
A grant isn't a one-way door. See Leaving for how to pause Beemy, turn a category back down, or delete a silo outright.
Read next
Get your time back.
Beemy is in private beta. Join the waitlist and go from connect to a quiet, triaged inbox before you close your laptop tonight.
You're in the hive. We'll buzz you when it's your turn.
While you waitLast updated