Google Meet Sensor

What it ingests

Google Meet meeting transcripts (Gemini-generated), titles, and participants. Coverage fans out across every member of the org by impersonating each Workspace user, so a single subject is no longer required for ingestion.

Credential

References a google_service_account_json credential by id. The secret is the full service-account key JSON. Leave it blank to fall back to application-default credentials (ADC) for local/dev use without impersonation.

curl -sS -X POST https://your-corveil-host/api/credentials \
  -H "Authorization: Bearer <admin>" -H "Content-Type: application/json" \
  -d @- <<'JSON'
{ "type": "google_service_account_json", "name": "acme-workspace-sa",
  "secret": "{\"type\":\"service_account\", ... }" }
JSON

The service account must have domain-wide delegation (DWD) enabled to impersonate Workspace users.

Config fields

All config fields are optional — with a DWD service account and no config, the sensor fans out across every org member.

Key	Notes
impersonate_subject	Connection-test user only. A Workspace user Test connection impersonates to probe Meet reachability. Not needed for ingestion.
member_allowlist	Comma-separated Workspace users. Restricts fan-out to these members (staged rollout / testing).
workspace_domains	Comma-separated domains. Only members whose email domain matches are impersonated; others are skipped.
directory_subject	When set, attendee emails are resolved via the Admin SDK Directory impersonating this user. Requires the broad admin.directory.user.readonly scope. Leave blank to keep attendees name-only.
poll_overlap_minutes	Minutes to re-scan before the last cursor, to catch transcripts that flipped to ENDED after a poll. Defaults to 30.

Provider-side setup

1. Create a service account in Google Cloud and download its key JSON.
2. Enable the Google Meet API on the project.
3. In the Workspace Admin console, enable domain-wide delegation for the service account and authorize the Meet read scopes (and admin.directory.user.readonly only if you set directory_subject).

The runbook and helper scripts live in corveil/corveil-sensors → google-meet/. Provisioning automation stays in that repo — do not paste key material into a sensor config.

Wire-up

POST /api/sensors

{
  "sensor_type": "googlemeet",
  "name": "Acme Google Meet",
  "config": {},
  "credentials": { "service_account_json": "<google_service_account_json credential id>" }
}

Staged rollout to two users first:

{
  "sensor_type": "googlemeet",
  "name": "Acme Meet (pilot)",
  "config": { "member_allowlist": "alice@acme.com, bob@acme.com" },
  "credentials": { "service_account_json": "<credential id>" }
}

Verify

Run Test connection. With a service account it impersonates impersonate_subject (or the directory_subject fallback) to probe Meet reachability; if neither is set it cannot probe and stays neutral. Once polling, newly ended meetings with transcripts appear as meeting events.