Google Workspace mailboxes

Workspace operators can configure domain-wide delegation with a separate credential. MailGen adds mailboxes through explicit enrollment. Delegation alone does not expose every mailbox in the application. See Google Cloud setup.

Managed encryption follows the mailbox's verified ownership and key context. App login, delegated Gmail access, and permission to decrypt content are separate requirements. A source or owner mismatch blocks content access.

Prepare Workspace authority before enrollment. Personal Gmail OAuth needs neither a Workspace administrator nor domain-wide delegation. Use personal mailbox authorization for that path.