Google Workspace and Drive — nothing here is mintable, so this engine's value is custody: the long-lived refresh token stays on the server and consumers only ever receive an access token good for about an hour. The consumer never holds the durable secret, which is most of the benefit.
Domain-wide delegation is offered as a second mode, but it is a materially
worse trade — see the caveats in doc() — and Google's own guidance is now
to avoid it for new integrations.
See docs/delegation/google-workspace.md for the mechanism and
docs/delegation/setup/google-workspace.md for the operator walkthrough.