GOOGLE WORKSPACE · TASKS
Courses, rosters, and coursework, scoped to the acting user.
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Put Google Classroom behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.