Gmail App Permissions, Scope by Scope

The scopes, from least to most powerful

1. 1gmail.labels — create, list and delete labels. Cannot read a single message. Harmless on its own and rarely requested alone.
2. 2gmail.send — send mail as you, and nothing else. It cannot read your inbox. Newsletter and CRM tools often use only this.
3. 3gmail.readonly — read every message, thread, attachment and label in the mailbox. It cannot change anything, which also means it cannot file, draft or reply.
4. 4gmail.compose — create, update and delete drafts, and send them. Combined with readonly it is a common assistant pairing.
5. 5gmail.settings.basic — read and write filters, forwarding, vacation settings, send-as aliases and signatures. It is also what Gmail requires to register a push notification watch on the mailbox.
6. 6gmail.modify — everything above in one scope: read, label, draft, send, move to Trash. The one thing it cannot do is delete a message permanently while bypassing Trash.
7. 7https://mail.google.com/ — full access, including permanent deletion beyond recovery. This is the one to think hard about. It is also the only scope that lets an app empty your Trash and Spam.

What that actually means

• •The consent screen's wording for gmail.modify and full access differs by a few words and one of them is irreversible
• •Scopes are all-or-nothing per mailbox — there is no way to grant access to one label, one sender or one date range
• •Google's include_granted_scopes behaviour means a later consent can quietly accumulate on top of an earlier one
• •Approving a scope on a work account may be blocked or silently allowed depending on your Workspace admin's settings, with no explanation shown to you