Google needs to be crystal clear to Apps users about what access their employers have to their account. I am surprised that they can change passwords. What else

Google needs to be crystal clear to Apps users about what access their employers have to their account. I am surprised that they can change passwords. What else can they do? Read mail sent outside the company? Read unsent drafts?