Google Chat API restrictions prevent agents from posting to Chat spaces

[krishagel]

Summary

Agents are unable to post messages to Google Chat spaces due to organization-level API restrictions. The Google Chat API rejects send operations with "This organization's administrator restricts this Chat app from performing this action" (router-level) and "Workspace operation is not allowed: chat +send" (broker-level, exit 12). Reading spaces works fine; only send operations are blocked.

Definition of Done

• Root cause identified: determine whether the restriction is an Admin console setting, a service account OAuth scope issue, or a Workspace broker allowlist gap
• Affected Google Chat spaces and agent scopes enumerated
• Proposed fix documented (e.g., enable chat send methods in Workspace broker allowlist for agent scope, or adjust Admin console Chat API restrictions)
• (manual) Admin approval obtained to apply the fix in production

Affected failures

ID	Occurred At (UTC)	User	Source	Error
254	2026-07-29 23:00:34	hagelk@psd401.net	router	"This organization's administrator restricts this Chat app from performing this action"
253	2026-07-29 22:54:53	hagelk@psd401.net	router	"This organization's administrator restricts this Chat app from performing this action"
252	2026-07-29 22:48:49	stolhanda@psd401.net	agent_self_report	"Workspace operation is not allowed: chat +send" (exit 12) — both gws chat +send and raw chat spaces messages create rejected
256	2026-07-29 23:13:48	hagelk@psd401.net	agent_self_report	"Workspace operation is not allowed: chat +send" (exit 12) — broker-level allowlist rejection

Affected users

• hagelk@psd401.net
• stolhanda@psd401.net

Error details

Router-level (IDs 254, 253):

Error: This organization's administrator restricts this Chat app from performing this action
    at Gaxios._request (/var/task/node_modules/gaxios/build/src/gaxios.js:129:23)
    at async sendGoogleChatResponse (/var/task/index.js:1699:5)
    at async handleOwnerTurn (/var/task/index.js:2827:5)
    at async Runtime.handler (/var/task/index.js:2202:21)

Broker-level (IDs 252, 256):

• Space "POW Editor Project" (spaces/AAQAiZ16kT8) and Chat space 007 (spaces/AAQA13FQZFA)
• Both gws chat +send and raw chat spaces messages create methods rejected with exit 12
• Reading the space (spaces.list, spaces.messages.list) works fine on the same agent credential
• Not the Phase 1 forbidden gate (exit 13) — this is a broker allowlist gap

Acceptance tests / E2E flows

N/A — this is an infrastructure/configuration issue, not a code change.

Affected areas

• Google Chat API integration (router: sendGoogleChatResponse)
• Workspace broker (psd-workspace chat +send)
• Admin console Chat API restrictions

Out of scope

• Implementing custom S3 upload workarounds
• Changing agent self-reporting behavior

Risk & rollback

• Risk: low — configuration change only
• Rollback: revert Admin console / broker allowlist changes

[krishagel]

This issue was created in the wrong repo. The correct issue is in psd401/aistudio.