Requesting full Gmail or Drive? Why you need a CASA assessment
Restricted scopes — reading the full mailbox or all of Drive — are a different, heavier process than sensitive-scope verification. The best fix is usually to avoid them by switching to a narrower scope.
Scopes like gmail.readonly, gmail.modify, full Gmail, drive, and drive.readonly expose the user's entire inbox or Drive, so Google classes them as restricted. Restricted scopes require a separate third-party security assessment (CASA) on top of verification — this is out of scope for a template-based pack, and special-category data (health, minors, biometrics) is a hard stop. Before committing to that path, it's worth checking whether a narrower, non-restricted scope covers your feature.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Restricted scopes require a security assessment by Google-empanelled assessors under the CASA framework, with a Letter of Assessment renewed at least every 12 months.”
“Every requested scope is classified non-sensitive, sensitive, or restricted — the category is shown per scope in the Cloud Console, and it decides your verification path.”
“Where a narrower scope exists, either switch to it or explain why it won't do — over-asking without a justification is itself a rejection ground.”
“Give one justification per sensitive scope, each tied to a specific feature a user can see.”
Do these in order.
- 01
Ask whether you truly need the whole mailbox / Drive
Most apps don't. If you only send mail, gmail.send is sensitive, not restricted. If you only touch files the user opens in your app, drive.file is non-sensitive. Switching scope avoids the assessment entirely.
- 02
If you can narrow, do it and justify normally
Move to the narrowest scope that supports your feature, then justify that scope per feature like any sensitive scope — no CASA needed.
- 03
If you genuinely need a restricted scope, plan for CASA
A restricted scope requires a security assessment by Google-empanelled assessors under the CASA framework, renewed annually — a real project in its own right. That path is out of scope for a template pack — the free pre-check will diagnose it and point you the right way.
- 04
Hard stop on special-category data
Apps handling health data or targeting under-16 users are a hard stop for this route — get specialist advice before proceeding.
What each scope actually grants.
The tier decides your path: non-sensitive needs only brand verification, sensitive needs a justification and demo video, and restricted needs a separate security assessment. Google’s scope categories →
| Scope | Tier | What it accesses |
|---|---|---|
| gmail.readonly | Restricted | Read all inbox content and metadata |
| gmail.modify | Restricted | Read, send, delete, and modify the mailbox |
| gmail | Restricted | Full mailbox access (read/send/delete) |
| drive | Restricted | All files in the user's Drive |
| drive.readonly | Restricted | Read all files in the user's Drive |
| drive.file | Non-sensitive | Only files the user opens/creates in the app |
| gmail.send | Sensitive | Send email on the user's behalf (no inbox read) |
Narrower alternatives exist (Google prefers the least access that works): drive → drive.file; drive.readonly → drive.file.
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Can you template a fix for full Gmail or Drive access?
No. Restricted scopes require a separate third-party CASA security assessment, which a template can't provide. We diagnose it for free and point you the right way — often a narrower non-restricted scope avoids it.
How do I avoid the restricted-scope process?
Switch to the narrowest scope that supports your feature — gmail.send instead of reading the inbox, drive.file instead of all of Drive. Those stay out of the restricted tier.