Google Meet Sensor

What it ingests

Google Meet meeting transcripts (Gemini-generated), titles, and participants. Coverage fans out across every member of the org by impersonating each Workspace user, so a single subject is no longer required for ingestion.

Note-taking is the capture gate

A meeting held without Gemini note-taking / transcription enabled produces nothing for this source to ingest — no transcript, no title, no attendee list. The connector emits a meeting only once it finds a usable transcript; a call that has none is skipped rather than recorded as an empty meeting.

That means capture scope is set by your Workspace's note-taking policy, not by this source's configuration. An org that enables note-taking deliberately, per meeting, gets exactly the meetings it chose to transcribe — even with the source fanned out org-wide. An org that leaves Gemini note-taking on by default gets much broader capture from the identical config.

Settle that policy before tuning the fields below; source-side scoping narrows which members Corveil reads, but it cannot narrow what Google already wrote down.

This source overlaps with the Google Drive sensor, which ingests the same Gemini notes when they land in a watched folder. See Choosing a meeting-capture path for a side-by-side comparison and a recommendation.

Credential

References a google_service_account_json credential by id. The secret is the full service-account key JSON. Leave it blank to fall back to application-default credentials (ADC) for local/dev use without impersonation.

curl -sS -X POST https://your-corveil-host/api/credentials \
  -H "Authorization: Bearer <admin>" -H "Content-Type: application/json" \
  -d @- <<'JSON'
{ "type": "google_service_account_json", "name": "acme-workspace-sa",
  "secret": "{\"type\":\"service_account\", ... }" }
JSON

The service account must have domain-wide delegation (DWD) enabled to impersonate Workspace users.

Config fields

All config fields are optional — with a DWD service account and no config, the source fans out across every org member (subject to the note-taking gate above).

Key	Notes
impersonate_subject	Connection-test user only. A Workspace user Test connection impersonates to probe Meet reachability. Not needed for ingestion.
member_allowlist	Comma-separated Workspace users. Restricts fan-out to exactly these members. A supported standing configuration for capturing one team's meetings — not only a staged-rollout aid.
workspace_domains	Comma-separated domains. Only members whose email domain matches are impersonated; others are skipped. Use it in a multi-domain Workspace to keep capture inside the domain that consented to it.
directory_subject	When set, attendee emails are resolved via the Admin SDK Directory impersonating this user. Requires the broad admin.directory.user.readonly scope. Leave blank to keep attendees name-only.
poll_overlap_minutes	Minutes to re-scan before the last cursor, to catch transcripts that flipped to ENDED after a poll. Defaults to 30.

Provider-side setup

1. Create a service account in Google Cloud and download its key JSON.
2. Enable the Google Meet API on the project.
3. In the Workspace Admin console, enable domain-wide delegation for the service account and authorize the Meet read scopes (and admin.directory.user.readonly only if you set directory_subject).

The runbook and helper scripts live in corveil/corveil-sensors → google-meet/. Provisioning automation stays in that repo — do not paste key material into a source config.

Wire-up

POST /api/sensors

{
  "sensor_type": "googlemeet",
  "name": "Acme Google Meet",
  "config": {},
  "credentials": { "service_account_json": "<google_service_account_json credential id>" }
}

Scope fan-out to named members — a staged rollout, or a standing single-team configuration:

{
  "sensor_type": "googlemeet",
  "name": "Acme Meet (pilot)",
  "config": { "member_allowlist": "alice@acme.com, bob@acme.com" },
  "credentials": { "service_account_json": "<credential id>" }
}

Verify

Run Test connection. With a service account it impersonates impersonate_subject (or the directory_subject fallback) to probe Meet reachability; if neither is set it cannot probe and stays neutral. Once polling, newly ended meetings with transcripts appear as meeting events.