{"slug": "google-workspace-mcp-mark-oauth-clients-agentic-by-nov-11", "title": "Google Workspace MCP: Mark OAuth Clients Agentic by Nov 11", "summary": "Google Workspace MCP servers will begin rejecting OAuth 2.0 clients not flagged with the `is_agentic` classification on November 11, cutting off AI agents that access Gmail, Drive, Docs, or Calendar over MCP. Google introduced the flag in October 2026 as a single checkbox in Google Cloud Console under Google Auth Platform > Clients; it grants no additional scopes and exists so Workspace administrators can separate agent traffic from standard app traffic in audit logs and policy controls. After November 12 the flag locks permanently on an existing client, so applications serving both humans and agents from one Client ID must split into two separate IDs or create a new Client ID and redeploy.", "body_md": "On November 11 — six days from now — Google Workspace MCP servers start rejecting OAuth clients not flagged as “agentic.” If your AI agents interact with Gmail, Drive, Docs, or Calendar via MCP, they go dark on that date. Miss November 11, and the problem gets worse: on November 12, the flag locks permanently on your existing OAuth client. After that, your only path forward is creating a brand-new Client ID and redeploying everything that depends on it.\n\nThis is not a deprecation warning with a long tail. It is a hard cutoff.\n\n## What Google Changed and Why\n\nIn October 2026, Google introduced the `is_agentic` classification on OAuth 2.0 clients. It is a single checkbox — “Use this client for an AI-powered agent” — in Google Cloud Console under Google Auth Platform > Clients. The flag does not grant additional scopes or permissions. It is a labeling mechanism that lets Google Workspace administrators differentiate AI agent traffic from standard app traffic in audit logs and policy controls.\n\nThe motivation is straightforward. Workspace MCP servers are more capable than REST APIs. An agent operating over MCP can compose and send emails, create and edit documents, schedule calendar events, and query across all of a user's Workspace data — not just read it. Enterprise admins managing thousands of users need visibility into which applications have this level of access and whether those applications are automated agents or human-interactive apps. The `is_agentic` flag is how Google gives them that visibility.\n\n## Who Is Affected\n\nIf you use any of the following, check your OAuth clients now:\n\n- Google Agent Development Kit (ADK) workflows connected to Workspace MCP\n- Gemini Enterprise connectors to Workspace apps\n- n8n automations using Workspace MCP server integrations\n- LangChain or LangGraph agents calling Workspace MCP endpoints\n- Open-source MCP servers like [taylorwilsdon/google_workspace_mcp](https://github.com/taylorwilsdon/google_workspace_mcp)\n- Any custom agent using Claude Code, Codex, or similar tools with Workspace MCP\n\nIf your application calls the Workspace REST APIs directly — not MCP — you are not affected. Service Account authentication is also unaffected. The enforcement targets OAuth 2.0 clients specifically used to authorize MCP server access.\n\n## The Fix Takes Two Minutes\n\nThe good news is that the fix is fast. Navigate to [Google Auth Platform > Clients](https://support.google.com/cloud/answer/15549257) in your Google Cloud Console. Find the OAuth 2.0 Client ID your Workspace MCP integration uses. Click edit, check “Use this client for an AI-powered agent,” and save. No code changes. No re-deployment. Done — provided you act before November 11.\n\nThe less good news: if you use the same OAuth client for both a human-facing login flow and an agent workflow, Google's documented best practice is to [split them into two separate Client IDs](https://dev.to/aiautomationplaybook/googles-nov-11-oauth-deadline-for-ai-agents-what-the-official-docs-actually-say-1p0). The `is_agentic` flag is permanent after November 12 — you cannot unset it on a flagged client, and a flagged client should be used exclusively for agent traffic. If your app today serves both humans and agents from one client, now is the time to separate them.\n\n## What This Actually Means for the Industry\n\nThe deadline is tactical. The bigger story is strategic.\n\nThis is the first formal OAuth-level separation of human and agent identity in a major enterprise productivity platform. Until now, an AI agent and a human user looked identical at the OAuth layer — both were just “an application” that a user had consented to. The `is_agentic` classification changes that. Agents become a distinct identity category with their own audit footprint, their own admin controls, and eventually their own permission model.\n\nJumpCloud called this direction “Agentic IAM” in 2026. Microsoft is building the same infrastructure into Entra ID. Atlassian, Salesforce, and every other enterprise platform with an MCP integration will follow. The [November 11 deadline](https://pulse.appsscript.info/p/2026/10/mark-ai-agent-oauth-clients-as-agentic-for-google-workspace-mcp-by-november-11-2026/) is not bureaucratic overhead — it is Google establishing the identity foundation that enterprise AI governance will be built on top of.\n\nIf you are building AI agents that touch business data, start treating agent identity as a first-class design concern. The [teams already updating their OAuth clients](https://dev.to/cortexflow_tech/google-workspace-will-block-ai-agents-without-this-oauth-flag-on-nov-11-the-n8n-builders-checklist-2c32) are ahead of this curve. The teams ignoring it will find out on November 11.", "url": "https://wpnews.pro/news/google-workspace-mcp-mark-oauth-clients-agentic-by-nov-11", "canonical_source": "https://byteiota.com/google-workspace-mcp-oauth-agentic-deadline/", "published_at": "2026-11-06 11:30:00+00:00", "updated_at": "2026-11-06 11:51:55.449327+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-policy", "ai-tools"], "entities": ["Google", "Google Workspace", "Google Cloud Console", "Google Agent Development Kit", "Gemini Enterprise", "n8n", "LangChain", "JumpCloud"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/google-workspace-mcp-mark-oauth-clients-agentic-by-nov-11", "markdown": "https://wpnews.pro/news/google-workspace-mcp-mark-oauth-clients-agentic-by-nov-11.md", "text": "https://wpnews.pro/news/google-workspace-mcp-mark-oauth-clients-agentic-by-nov-11.txt", "jsonld": "https://wpnews.pro/news/google-workspace-mcp-mark-oauth-clients-agentic-by-nov-11.jsonld"}}