Authorizing an app

What the consent screen shows

When someone authorizes an app they see its name, and every permission it is asking for — written as a label and a description, not as a raw scope string.

Permissions marked sensitive are unchecked by default and have to be granted deliberately. That covers things like candidate email bodies, conversation transcripts, billing, and the audit log.

If the person belongs to more than one organization, they choose which one the app connects to. The app reaches that organization and no other.

What the app can then do

It acts as that person, in that organization, limited to what they approved — and never more than their own role allows. So an app granted billing:read by a member still reads nothing, because billing needs an organization admin.

Access ends when they revoke it, or when they lose access to the organization themselves.

Seeing and revoking connections

Settings → Authorized apps lists what you have connected. Organization admins get an admin view of every grant in the organization, and can revoke any of them.

Revoking takes effect on the app's next request. It does not wait for the token to expire.

Restricting which apps your members can connect

Organization admins can require approval:

Settings → Authorized apps → Third-party applications → Require admin approval.

With approval off (the default), members may authorize any application. With it on, only applications an admin has approved can be authorized.

Changing the policy affects new authorizations only. Connections that already exist keep working until you revoke them, which you do from the same page — so tightening policy for the future and cutting off people who are working right now stay separate decisions.