Claude can send mail and delete events; owners decide who skips the approval prompt

Anthropic's Google Workspace connectors let Claude send, reply to and forward Gmail messages, create, update and delete calendar events, and share, move and trash Drive files ^[2][3][4]. The capability list is not the decision an operator has to make; the decision is who gets to turn off the approval prompt, and on Team and Enterprise plans that is the owner's call rather than the member's ^[6].

There are two gates, in order. On Team and Enterprise plans an Owner or Primary Owner must enable the connectors at the organization level before any individual user can authenticate ^[5]. Once they are on, the default is that each action Claude takes on your behalf requires explicit approval, and owners decide whether members can allow certain actions to run without asking each time ^[6]. Turning a member into an unsupervised sender is therefore a two-step administrative act, both steps owner-controlled ^[18].

The word doing the work is "certain". The per-action approval caveat is printed against Gmail send, reply and forward, and against Drive share, move and trash ^[2][4]. The general statement covering all tool use says "certain actions" without listing them ^[19]. The Calendar section lists creating, updating and deleting events with full customization and does not repeat the caveat ^[20]. For an owner writing policy, that gap is the question: waiving approval on drafting is a convenience, while waiving it on send, trash and delete changes what leaves the company and what stops existing.

The constraints that do exist are worth knowing. Anthropic says Claude mirrors your existing Workspace permissions and cannot access information you do not already have access to ^[7], and that it accesses data only when you explicitly ask, retrieving the minimum needed ^[8]. Responses include citations to the emails, events and documents used, with links to the originals where available ^[9]. Members can toggle individual connectors on and off from the plus menu below the chat ^[10]. Attachment metadata is available to the Gmail connector; attachment content is not ^[17]. In projects, the Drive connector works only when adding to Files in private projects and is disabled for shared projects ^[15], and saving Claude-generated files back to Drive requires code execution and file creation to be enabled ^[16].

9to5Google, reporting the Gmail sending capability, called the previous inability to send a notable omission and described the new behaviour plainly: asking Claude to reply to an email can send the response sight-unseen, although the user still has to ask for the action ^[11][12]. Anthropic's line to that publication was: "Ask Claude to reply to a thread, and it drafts and sends the response. You control when it needs your approval." ^[13] On a managed plan, "you" resolves upward: the owner decides whether the member is allowed to make that choice at all ^[6]. The functionality is limited to paid plans, according to 9to5Google ^[14].

The citations Claude attaches to its answers are a record of what it touched ^[9], but they sit inside the conversation, which is where the member looks and not where an owner looks. That is the practical shape of the risk: a connector that can send and delete, with the approval switch delegated one level down from the person who will be asked to explain the outgoing message.