GOG CLI setup with L1 safety profile for AI agents

gog-setup.md

GOG CLI Setup with L1 Safety Profile

Set up the GOG CLI with compile-time safety restrictions so your AI agent can access Google Workspace (Gmail, Calendar, Drive, Docs, Sheets, etc.) without being able to send emails, messages, or take other outbound actions.

Prerequisites

• Go 1.22+
• macOS or Linux
• The credentials.json file (you should have received this from Brenner)

1. Build the L1 safety-profiled binary

L1 ("Draft & Organize") lets the agent do anything to your own stuff — read email, create drafts, organize files, edit docs — but blocks all outbound actions (sending email, chat messages, comments, RSVPs). Blocked commands are physically removed from the binary at compile time — there's no runtime flag or env var to bypass them.

Pull down the gog-safety skill and build:

git clone https://github.com/tychohq/agent-skills.git
cd agent-skills/skills/gog-safety
./scripts/build-gog-safe.sh L1

Install the binary:

sudo mv /tmp/gogcli-safety-build/bin/gog-l1-safe /usr/local/bin/gog
sudo chmod +x /usr/local/bin/gog

Verify:

gog --version
# Should show a version with -safe suffix

2. Register the OAuth credentials

gog auth credentials set ~/Downloads/credentials.json

3. Authorize your Google account (all services)

gog auth add you@gmail.com --services all

Replace you@gmail.com with your actual email.

This opens a browser window. Sign in with your Google account and approve all requested permissions.

Note: Google will show a "This app isn't verified" warning. Click Advanced → Go to (app name) to proceed.

Verify it worked:

gog auth list

4. Verify safety restrictions

# This should fail (blocked at L1):
gog gmail send --help

# These should work (allowed at L1):
gog gmail drafts create --help
gog gmail search --help
gog calendar events --help

What's blocked at L1?

Action	Status
Read email, search, labels	✅ Allowed
Create/edit drafts	✅ Allowed
Edit Google Docs/Sheets	✅ Allowed
Manage Drive files	✅ Allowed
Calendar create/view events	✅ Allowed
Send email	❌ Blocked
Send chat messages	❌ Blocked
RSVP to events	❌ Blocked
Post comments on shared docs	❌ Blocked

Safety level reference

The gog-safety skill includes three levels:

• L1 — Draft & Organize: No outbound messaging. Default for AI agents.
• L2 — Draft & Collaborate: Adds comments, RSVP, but still no direct messaging.
• L3 — Full Write (No Admin): Full messaging, but no dangerous admin ops.

See the full level reference for details.