Use cases → Email operations
Scan all inbound attachments for viruses at domain scale
Pull attachments from every user's inbox using a delegated service account and scan them for malware before allowing access.
| Who it is for | Security and IT teams in regulated or high-risk environments. |
|---|---|
| APIs | Gmail API, Drive API |
| Typical scopes | gmail.readonly, drive.readonly |
The problem
Relying on user devices or built-in Gmail protections alone is not enough in environments with strict compliance or where users sync mail to unmanaged clients. Manual review is impossible at scale, and missed malware can lead to costly breaches.
How it works
- Use domain-wide delegation to impersonate each user and list recent messages with attachments via the Gmail API.
- Download attachments in batches to a secure scanning environment.
- Run antivirus and threat detection tools on all files.
- Quarantine or flag messages in place if malware is detected, and alert security operations.
What changes
All inbound attachments are scanned centrally, and malware is caught before reaching end users or downstream systems.
Watch it explained
“IAM Concerned: OAuth Token Hijacking in Google Cloud (GCP) - Jenko Hwong (DEF CON Cloud Village)” — Cloud Village on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.
Questions people ask
Does this catch files shared via Drive links?
No, only actual attachments in email messages are covered. For Drive links, you must separately scan files with the Drive API.
How do you avoid throttling or quota errors?
Batch requests, respect exponential backoff, and coordinate scans to avoid bursts at peak times. Monitor quota usage and handle 429 errors with retries.
Want this built?
This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.
Talk to us Or read the setup guideRelated use cases
Deliver onboarding welcome kits via delegated automation
Automatically send onboarding materials to new users, ensuring every new joiner receives the correct resources as soon as their account is provisioned.
Draft replies automatically in a shared inbox
A delegated service account reads an incoming enquiry, drafts a researched reply in the mailbox, and leaves it for a human to approve and send.
Triage and route inbound mail across a domain
Classify every inbound message, label it, and forward the ones that matter to the person who owns them — without touching a single mail rule.