Agentic Fabriq
Google Chat
MESSAGING · MESSAGING
Post and read in the spaces that person already belongs to.
Connecting Google Chat in practice
Google Chat’s write ceiling is per space rather than per project: one request per second for spaces.messages.create, patch, delete and media.upload, against 3,000 message writes a minute for the whole project — so an app well under its project budget still throttles when the traffic lands in one busy room. Reading message text needs chat.messages or chat.messages.readonly, which Google classes as restricted scopes.
Scopes that draw scrutiny
https://www.googleapis.com/auth/chat.messagesRestricted. Read and write messages, the widest message grant, so it pulls the app into the annual security assessment by Google-empanelled assessors.https://www.googleapis.com/auth/chat.messages.readonlyRestricted even though it writes nothing, which surprises teams who chose it to stay out of review.https://www.googleapis.com/auth/chat.deleteRestricted. Deletion is its own scope, so an app holding it asked for destruction specifically.https://www.googleapis.com/auth/chat.app.messages.readonlyRestricted and, like every chat.app.* scope, requires a one-time administrator approval before a service-account app can use it.https://www.googleapis.com/auth/chat.admin.membershipsSensitive. Manages memberships as a Workspace administrator rather than within the spaces one user belongs to.
Rate limits
- Per space, per second: 1 write for spaces.messages.create, patch, delete and media.upload; 15 standard reads; 5 reaction writes; 10 message creates in data-import mode.
- Per project, per 60 seconds: 3,000 message writes, 3,000 message reads, 300 message searches, 300 membership writes, 3,000 membership reads, 60 space writes, 3,000 space reads.
- Per project, per 60 seconds: 600 media.upload calls, 3,000 attachment reads, 600 reaction writes, 3,000 reaction reads.
- Per user, per second: 1 write and 15 reads for sections and availability.
- Exceeding a quota returns 429 Too many requests.
Who has to approve
The chat.app.* scopes — chat.app.spaces, chat.app.spaces.create, chat.app.spaces.readonly, chat.app.memberships, chat.app.memberships.readonly, chat.app.messages.readonly and chat.app.delete — require a one-time administrator approval for a Chat app using service account authentication. App-authority access to spaces is therefore a Workspace admin decision, not something the connecting user can grant.
Worth knowing
- App authentication and user authentication need different scopes for the same call: creating a message is chat.bot as the app and chat.messages.create as the user, so switching identity means re-requesting consent.
- The identity is visible in the room either way — posting as the app shows an "App" label next to the sender, and posting as a user attributes the message to that person with the app named alongside.
- chat.import is restricted and puts a space in import mode, where the per-space message-create limit rises to 10 per second; that path is not interchangeable with ordinary posting.
- Restricted scopes have to be re-verified and re-assessed at least every 12 months after the assessor’s Letter of Assessment, so the cost of a message-reading Chat app recurs annually.
Checked against Chat API usage limits (2026-09-29), Chat authentication and authorization scopes (2026-09-29), Restricted scope verification (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Google Chat behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.