Connect Google Calendar
An account of Google Calendar is connected once, on the instance, by a person who then gives missions access to its resources; the agent never receives the credential. Google Calendar through Google's own Calendar MCP server: read the agenda, suggest a time, create, change and delete events, answer invitations — one resource per calendar.
One account is one Google account: you sign in at Google through the OAuth broker this gateway is enrolled with, with nothing to create or paste. One resource is one calendar of that account; a mission touches only the calendars it was given. Inviting people of the company and people outside it are separate permissions, decided by each calendar's internal domains, and so are letting Google email the guests of a change, and deleting.
Permissions, presets and tools of this service: Google Calendar plugin.
How to connect
On the instance: Accounts → Connect an account, then pick the service. Most services take a key the person creates at the service and pastes (a token, or for Gmail an app password); nobody declares anything beforehand. A service that signs people in through its own authorization (Miro) needs nothing either: the gateway registers its own client there the first time someone connects. Every instance has its own client: this gateway never uses one shared with another instance.
The way: by signing in at the service and allowing the gateway (nothing to create or paste: the gateway registers its own client there)
Scopes asked: https://www.googleapis.com/auth/calendar.calendarlist.readonly, https://www.googleapis.com/auth/calendar.events.readonly, https://www.googleapis.com/auth/calendar.events.freebusy, https://www.googleapis.com/auth/calendar.events.
Disconnecting
In your Google account, open Security, then 'Third-party apps with account access', and remove the app this gateway signed you in with.
Registration notes from the plugin
From the plugin's README, written for the people who create the key.
Credential and resources
oauth2 with broker: { provider: 'google' }. An administrator enrolls the
instance with a broker (oauth_brokers.<name>.url and .key, handbook
configuration); without one, the plugin is listed as not configured. One
resource per calendar of the account (ref alice~acme.example), with
internal_domains, the list that decides who is a colleague.