Overview

Workspace Tenant

Per-organisation Google Workspace Domain-Wide Delegation config (F3.SELFSERVICE.02). service_account_key_encrypted / service_account_email / admin_email are private:true and AES-256-GCM encrypted at rest (service_account_key_encrypted only) — the controller’s toSafe() projection never returns them; callers only see masked is_configured / has_admin_email booleans.