Funny story: I was creating a script that would download attachments from an arbitrary (enterprise) gmail account, then do some processing on it. This was basi

Funny story: I was creating a script that would download attachments from an arbitrary (enterprise) gmail account, then do some processing on it. This was basically a hack we devised because there wasn't an API to fetch the file we needed programmatically, but we could schedule an email to be sent with the file as an attachment. I decided that I didn't want to deal with maintaining a gmail oauth token, so I went down the rabbit hole of getting my service auth set up as a gsuite admin. It turned out to work fine, no more oauth token necessary. But then I thought for a second, and changed the email address from the the junk one I setup specifically for this task to mine, and it worked. So I tried my colleagues (with their knowledge) and it worked as well. Turns out giving your service account admin rights means giving them full access to the entire company's accounts. So with a sigh and a dammit, I went back to using the oauth token. I couldn't find any way to be a "limited" gsuite admin over just some set of email addresses; it was all-or-nothing. This seems like a strange oversight on Google's part, but I also could have missed some documentation.