Connect Grok Bot to Google Calendar

Connect Grok Bot to Google Calendar and verify a real booking safely.

Introduction

30 Second Summary

A real booking can turn a friendly conversation into a useful business decision. The connection behind that booking can also expose more of your work than the job needs.

In this project, you will give Scout one controlled Google Calendar connection inside Grok Bot. You will use it for one real Clarity call while every Google Workspace setting stays in your hands.

What You'll Build

You'll open a real Clarity booking beside Scout's matching one-line call prep.

By the end of this project, you'll have:

Dated founder record: Show seven Google Workspace settings with the page name plus the date you checked each one.
Controlled Calendar access: Prove the boundary through Scout's refusal before the plugin. Show one event title after the connection.
Real Clarity call: Match your business-owner friend's 30-minute booking to Scout's one-line prep.
Secret Mission: Audit the operating files against the live plugin, booking page, calendar event, and plan meter without asking Scout to judge its own work.

Are there any prerequisites?

You'll need your paid Grok Bot plan, paid Google Workspace account, company account, Windows computer, and one friend who runs a business.

Google Calendar is the only plugin you add, so you need no new app.

Before We Start

Before the hands-on work begins, this is your moment to confirm your Windows access to the paid Grok Bot plan and paid Google Workspace company account. You are committing to a real 30-minute Clarity call booking from a business-owner friend while Pineapple Advisory keeps the project free of real company names or full personal names.

Set Up the Human Boundary

Calendar access comes later. First, you need a human-controlled boundary around the company account.

You will check spending before any connector exists. Auto-review gates, Scout's durable rules, and an empty connection register will make that boundary visible.

In this step, get ready to:

Message your business-owner friend about the real 30-minute booking.
Check usage before configuring Scout's approval gates.
Create the six-column connection register before adding any plugin.

Confirm the participant and company account

The booking begins with a clear agreement from a real participant. Your friend has already agreed to take part, so this message explains the next action.

Send your business-owner friend this booking note:

A booking link is coming. Please book a real 30-minute call while I stay with you. Scout will read that booking through Calendar.

Why Message First?

This message sets a concrete 30-minute action. It also explains how Scout will be used after the booking reaches Calendar.

Confirm the message appears in the conversation with a sent status.

The Google Workspace Admin console controls settings for the company account. Your Workspace edition determines which features you can configure later.

Your company administrator password stays on Google's sign-in page. Scout never sees it.

Press the Windows key to open Windows Search.
Type Microsoft Edge and press Enter to open it.
Go to admin.google.com.
Sign in with the managed company administrator account.
Select Menu in the Admin console.
Select Billing.
Select Subscriptions.
Select the Google Workspace subscription.

You should see the Workspace edition and payment plan for the company account. Keep the edition private from Scout.

Can't See the Subscription?

Confirm that the account belongs to the company domain. A personal Google account cannot open the managed Admin console.

Ask for help: Why can't my company administrator account see Billing and Subscriptions?

Complete the Grok Bot cold start

The paid plan needs a visible spending checkpoint before Scout starts work. Grok Bot shows weekly included usage in its settings for eligible accounts.

Press the Windows key to open Windows Search.
Type Grok Bot and press Enter to open it.
Open Settings.
Select Usage & Billing.
Record the displayed weekly usage here: weekly usage number or not shown.
Enter not shown if the weekly meter is absent.
Confirm the visible on-demand usage status is off.
Use the control shown on the page to switch on-demand usage off if it is on.

That gives you a spending checkpoint before Scout receives any outside connection. Your existing plans remain unchanged.

Auto-review is the approval system that pauses matching actions for your decision. Require Approval rules always stop actions that match them.

Return to Settings.
Select General.
Select Auto-review.
Add a Require Approval gate for sending.
Add a Require Approval gate for publishing.
Add a Require Approval gate for purchasing.
Add a Require Approval gate for deleting.
Add a Require Approval gate for overwriting outside /workspace/pineapple/.

Why Require Approval?

Each gate forces a review before Scout completes a matching action. The gates support narrow permissions and explicit task boundaries.

Add a Require Approval gate for changing permissions.
Add a Require Approval gate for filing a form.
Add a Require Approval gate for accepting terms.
Add a Require Approval gate for opening an account.
Add a Require Approval gate for moving company data outside /workspace/pineapple/.

You should now see separate approval coverage for all ten action categories. Scout must stop for your decision whenever one of these rules matches.

A Bot description stores rules that should remain true across tasks. Scout needs one narrow job before the checklist work begins.

✔️ Scout Is Already Listed

Select Scout from the Bot list.
Confirm Scout is the only Bot listed.
Enter Writing the Workspace checklist and reading one Calendar event as Scout's primary job.

ⓧ Scout Is Missing

Choose Create your own from the Bot list.
Enter Scout as the short name.
Enter Writing the Workspace checklist and reading one Calendar event as Scout's primary job.
Confirm Scout is the only Bot listed after creation.

Add Scout's durable rules to its description by using this text:

Research only.
Name the official source page for every claim.
Write only under /workspace/pineapple/.
Never sign in.
Never send.
Never accept terms.
Never change a setting.
Stop at each review point.

What Do These Rules Control?

The description limits Scout to research and writing inside /workspace/pineapple/. Sign-ins and settings remain founder-owned actions.

Save Scout's description.
Return to the Bot list to confirm Scout remains the only Bot.

Scout's Rules Did Not Save?

Reopen Scout from the Bot list. Check whether the description still contains every durable rule before continuing.

Ask for help: Help me check whether Scout's durable rules were saved correctly.

Create the connection register

A connection register records every app that can reach company data. Creating it before the first plugin gives you a clean baseline.

Switch to Scout's chat.
Create the baseline register by sending this request:

Create /workspace/pineapple/ops/CONNECTIONS.md if it is missing.
Use exactly six columns: App | Account | Bot whose job uses it | Date | Day that needs it | Revoke date.
Start with one baseline row that says no app is connected.
Never put a password, code, recovery secret, account address, or full personal name in this file or in chat.

Why Start With No Connection?

The baseline row proves the register existed before Calendar access. Later, the first active connection replaces this row with a dated record.

Open the returned /workspace/pineapple/ops/CONNECTIONS.md file card.
Confirm the header contains exactly six columns.
Confirm the baseline row states that no app is connected.
Confirm the file contains no account address.
Confirm the file contains no full personal name.
Confirm the file contains no password, code, or recovery secret.

Register Has the Wrong Shape?

Tell Scout to fix the existing file in place. Keep the six required headers in their original order.

Ask for help: Help me compare my connection register with the required six-column baseline.

✔️ Awesome, I've Got Everything

Great. Your register now captures the clean state before any plugin exists.

ⓧ I'd Like to Double Check the Full Code

Compare your complete register with this six-column baseline.

| App | Account | Bot whose job uses it | Date | Day that needs it | Revoke date |
| --- | --- | --- | --- | --- | --- |
| No app connected |  |  |  |  |  |

Before you check the boundary, do you expect to find any active plugin connection?

Switch back to Grok Bot Settings.
Select Plugins.
Inspect the active connection list.
Return to Auto-review.
Inspect the complete approval gate list.
Return to the Bot list.
Inspect Scout's saved job and durable rules.
Switch back to /workspace/pineapple/ops/CONNECTIONS.md.

You should see no active Google Calendar, Gmail, files, sheets, or other new plugin connection.

Your register should show one six-column baseline row. Your Auto-review list should cover all ten action categories.

Scout should remain your only Bot. Its saved job and durable rules should match the boundary you configured.

Your human boundary is in place. Next, Scout will draft the Workspace checklist and stop after three setting lines for your review.

Build the Workspace Checklist

You have already placed the Auto-review gates around Pineapple Advisory. Scout remains the only Bot in Grok Bot.

The Google Workspace checklist needs to become useful before Google Calendar access exists. This separation keeps the draft independent from Calendar data.

In this step, Scout writes a partial WORKSPACE.md file for your review. Your continue unlocks the rest only after the first three lines pass.

In this step, get ready to:

Give Scout the five-part checklist request.
Review Scout's three-line stop against every boundary rule.
Complete the seven-line draft without granting Calendar access.

Give Scout the five-part ask

The request separates the desired outcome from its sources. Its review point limits Scout to a small result that you can inspect before more work continues.

Before you send the request, do you expect Scout to complete all seven lines or stop after the first three?

Switch back to Scout's conversation from the earlier setup.
Create the checklist draft by sending this request as one message:

Outcome. Create Pineapple Advisory's dated Google Workspace checklist before you read Calendar.

Sources. Use only Google's own help pages for the seven settings. Use the official Grok Bot documentation for the plugin line. Name each source page in words. Do not paste a web address. Mark every edition-dependent item `check your edition`.

Constraints. Make seven setting lines in this order. 1. Recovery phone, a second recovery email, and Super admin account recovery. 2. Two-step verification on my own account first, spare one-time backup codes kept with company papers, then enforcement for everyone. 3. A company-named Shared drive; check your edition. 4. Calendar working hours and Primary time zone. 5. A 30-minute Clarity call Appointment schedule with the Booking form question `What is the one thing you want clarity on?`; check your edition. If Appointment schedule is unavailable, use one fixed weekly 30-minute Clarity call slot in my Gmail signature. 6. Google Meet recording availability and `Let people record their meetings`; check your edition. 7. My chosen user storage limit and the organization's total storage limit. Do not choose the user limit for me. Each line must name the setting, the Google page where I work it, and `[ ] Done by me: YYYY-MM-DD`. After the seven settings, add one empty `Plugin check` line naming Grok Bot Settings → Plugins and Google Admin console API controls. Leave that line undated until I complete the refusal-then-read run. Do not open a page, sign in, change a setting, or use Calendar.

Deliverable. Create `/workspace/pineapple/ops/WORKSPACE.md`. Start it with `Purpose: your dated record of seven Google Workspace settings, one Calendar plugin, and the first real booking.` Add empty headings for `Plugin check`, `Proof`, and `First booking` after the seven settings. Return the file for review.

Review point. Write the purpose line and only the first three setting lines. Stop. Show the file. Wait for the single word `continue`.

How does the five-part request work?

The Outcome defines the operating record that Scout is drafting.
The Sources section limits claims to official documentation.
The Constraints section fixes the seven-setting order. It also keeps Scout away from sign-in pages.
The Deliverable section fixes the file path. It also defines the headings that later evidence uses.
The Review point section pauses Scout after three lines. Your approval controls whether drafting continues.

Wait for Scout to return the WORKSPACE.md file card.
Preview /workspace/pineapple/ops/WORKSPACE.md from the file card.

You should see the purpose line followed by Recovery, Two-step verification, and Shared drive. That three-line stop is your review point working.

Scout did not stop?

Tell Scout to remove every setting after Shared drive if it drafted all seven lines.
Tell Scout to restore the purpose line if the file starts directly with the checklist.
Stop the task if Scout opened a page or attempted to sign in.

Ask for help: Help me restore Scout's three-line review point without granting Calendar access.

Review the three-line stop

The first three lines prove that Scout can follow the checklist structure without acting inside Google. Your review checks the source wording before the remaining settings inherit the same pattern.

Confirm the file begins with Purpose: your dated record of seven Google Workspace settings, one Calendar plugin, and the first real booking.
Confirm the three setting lines appear in this order: Recovery, Two-step verification, Shared drive.
Check that every setting line names an official Google page in words.
Confirm that no web address appears in the file.
Check that the Shared drive line includes check your edition.
Confirm that Scout stopped after the Shared drive line.
Check that Scout did not open a page or read Calendar.

Does a line fail review?

Describe each mismatch in Scout's conversation.
Tell Scout to fix /workspace/pineapple/ops/WORKSPACE.md in place.
Repeat the full three-line review before continuing.

Ask for help: Help me check Scout's first three checklist lines against the review rules.

Finish the draft without granting access

The approved first three lines now anchor the rest of the file. Scout can append settings four through seven while the Calendar door stays closed.

Reply to Scout with the single word continue.
Wait for Scout to return the updated WORKSPACE.md file card.
Preview the updated file from Scout's conversation.

You should see seven ordered setting lines followed by empty Plugin check, Proof, and First booking headings. The Plugin check must remain undated.

Compare Scout's completed draft with the full reference below.

✔️ Awesome, I've got everything!

Your seven-setting draft is complete. Keep every checkbox undated until you work its setting yourself.

ⓧ I'd like to double check the full code

Compare each line with Scout's completed WORKSPACE.md file.

Purpose: your dated record of seven Google Workspace settings, one Calendar plugin, and the first real booking.

1. Recovery phone, second recovery email, and Super admin account recovery - named official Google account and Admin console pages - [ ] Done by me: YYYY-MM-DD.
2. Two-step verification on the company account, backup codes held with company papers, and organization enforcement - named official Google account and Admin console pages - [ ] Done by me: YYYY-MM-DD.
3. Company-named Shared drive - named Google Drive or Admin console page - check your edition - [ ] Done by me: YYYY-MM-DD.
4. Calendar working hours and Primary time zone - named Google Calendar settings page - [ ] Done by me: YYYY-MM-DD.
5. 30-minute Clarity call Appointment schedule with booking-form question `What is the one thing you want clarity on?`, or fixed weekly 30-minute Clarity call Gmail-signature fallback - named Google Calendar or Gmail page - check your edition - [ ] Done by me: YYYY-MM-DD.
6. Google Meet recording availability and `Let people record their meetings` - named Admin console Meet page - check your edition - [ ] Done by me: YYYY-MM-DD.
7. Chosen user storage limit and organization total storage limit - named Admin console storage page - [ ] Done by me: YYYY-MM-DD.

Plugin check

Proof

First booking

Before the final check, do you expect Scout's drafting work to have created a plugin connection?

Return to Grok Bot Settings.
Select Plugins.
Confirm that no new plugin connection is active.
Switch back to /workspace/pineapple/ops/WORKSPACE.md.
Confirm that the file contains all seven setting lines plus the three empty headings.

You should see no Google Calendar connection in Plugins. You should see the complete undated draft in WORKSPACE.md.

The review point has done its job. Scout produced the full checklist without opening Google or reading Calendar.

Your founder-owned checklist is ready for action. Next, you will work each Google setting yourself before opening one controlled Calendar connection.

Configure Settings and Connect Calendar

Your reviewed checklist now maps the seven Google Workspace settings that Pineapple Advisory needs. Each line becomes evidence only after you work the named setting yourself.

This step keeps human approval at the centre of every change. You will enable two-step verification before proving that Google Calendar is closed to Scout. You will then add one read-only plugin through Google's sign-in screen.

In this step, get ready to:

Work all seven settings on their named Google pages.
Prove Scout cannot read Calendar before a plugin exists.
Connect only Google Calendar before capturing one event title.

Work and date the seven settings

Recovery settings protect access to the company account. The checklist records your decisions without exposing recovery details.

These changes affect company access, so keep every password and recovery secret on Google's screens. Nothing sensitive belongs in Scout's chat or the project files.

In Microsoft Edge, open the company Google Account in a new tab.
Select Security & sign-in.
Open Recovery phone.
Add the company account's recovery phone.
Return to Security & sign-in.
Open Recovery email.
Add the second recovery email.

You should see the intended recovery phone status. You should also see the intended recovery email status.

Switch back to the company Google Workspace Admin console from earlier.
Select Menu.
Select Security.
Select Authentication.
Select Account recovery.
Open Super admin account recovery.
Enable Allow super admins to recover their account.
Select Save.

You should see Super admin account recovery set to the option you selected. Line 1 now has three settings that you personally checked.

Your own second sign-in method must work before organization enforcement begins. This order reduces the risk of locking the administrator out.

Return to the company Google Account tab.
Open Security & sign-in.
Select Turn on 2-Step Verification under How you sign in to Google.
Complete the on-screen steps with your available second sign-in method.

You should see 2-Step Verification enabled for your company account. This confirms your personal enrollment before organization enforcement.

Backup codes are live recovery credentials, so handle this part carefully. Keep the printed set with company papers and exclude it from every screenshot.

Open 2-Step Verification in the company Google Account.
Select Continue under Backup codes.
Select Print.
Store the printed codes with the company papers.

Your backup codes should now exist only with the company papers. No code should appear in Scout's chat or either project file.

Return to the Admin console.
Open the organization 2-step verification page named in checklist line 2.
Enable Allow users to turn on 2-Step Verification.
Set Enforcement to the option you chose for the organization.
Select Save.

You should see the organization setting enabled with your chosen enforcement state. Your own account is already enrolled.

Why does the order matter?

Personal enrollment proves that your administrator account has a working second sign-in method. Organization enforcement can then begin from a tested account.

Backup codes provide a recovery path when your normal second step is unavailable. Their safest place is offline with the company papers.

A Shared drive keeps company material under the organization's ownership. Its availability depends on your Google Workspace edition.

✔️ Shared drives are available

Open Google Drive in a new Edge tab.
Select Shared drives.
Select New.
Enter Pineapple Advisory as the Shared drive name.
Select Create.

You should see the Pineapple Advisory Shared drive in the Shared drives list.

Shared drive missing?

Confirm that you used the company account. Check that the edition you noted supports Shared drive creation.

Ask for help: Help me check whether my Google Workspace edition supports Shared drive creation without sharing my company domain or account details.

ⓧ Shared drives are unavailable

Your edition does not provide this checklist feature. The confirmed limitation becomes the evidence for line 3.

Record Not available in this edition, checked 2026-09-15 on checklist line 3.

You should see the edition limitation recorded with today's date.

Calendar working hours tell people when you normally accept meetings. The Primary time zone keeps every booking anchored to your scheduling location.

Open Google Calendar in a new Edge tab.
Select Settings.
Open Working hours under General.
Enable Enable working hours.
Set the working days and times you use for Pineapple Advisory.
Open Time zone.
Set Primary time zone to your company scheduling location.

You should see your chosen working hours. You should also see the correct Primary time zone.

Your Workspace edition determines which booking front door you can use. Follow the path that matches what Calendar offers.

✔️ Appointment schedules are available

Select Create in Google Calendar.
Select Appointment schedule.
Set Appointment duration to 30 minutes.
Set the general availability for the Clarity call.
Open the booking page settings.
Select Add an item under Booking form.
Enter What is the one thing you want clarity on? as the booking question.
Select Save.

You should see a 30-minute Clarity call booking page with the added question.

Booking question missing?

Return to the booking page settings. Confirm that the question sits under the Booking form section.

Ask for help: Help me add the Clarity call question to my Google Calendar booking form without sharing the booking link or account details.

ⓧ Appointment schedules are unavailable

The fixed weekly slot gives your friend one clear fallback for requesting the real call. You remain responsible for adding the confirmed booking to Calendar.

Open Gmail in a new Edge tab.
Select Settings.
Select See all settings.
Select General.
Find Signature.
Add one fixed weekly 30-minute Clarity call slot to the company signature.
Select Save Changes.

You should see the fixed Clarity call slot in the saved company signature.

Meet recording is another edition-dependent setting. Your record must show whether the company account can enable it.

Return to the Admin console.
Open the Google Meet recording page named in checklist line 6.
Check whether recording is available for your edition.
Enable Let people record their meetings when the setting is available.

A supported edition should show meeting recording enabled. An unsupported edition gives you a confirmed limitation for line 6.

The storage page shows the organization's total allowance. It also gives you the context for choosing a user limit without letting Scout make that decision.

Select Menu in the Admin console.
Select Storage.
Read the organization's total storage limit at the top of the page.
Set the user storage limit to the amount you chose.

You should see your selected user limit. The page should also show the organization's total storage limit.

Return to /workspace/pineapple/ops/WORKSPACE.md.
Mark every completed setting line with [x] Done by me: 2026-09-15.
Record Not available in this edition, checked 2026-09-15 on each unavailable edition-dependent line.
Confirm that the Gmail fallback is recorded on line 5 when Appointment schedule was unavailable.
Preview the updated checklist.

You should see all seven setting lines checked or marked unavailable with the date 2026-09-15. The Plugin check line should remain empty and undated.

Test the closed Calendar door

A before-and-after test isolates the access change. The request must stay identical across both runs.

Before you ask, do you think Scout can return an event title from the next seven days?

Return to Scout and send this exact request:

Read my calendar for the next seven days and list the events.

Why use this exact request?

The request asks for one narrow Calendar read. Reusing it after connection gives you a direct comparison.

The seven-day instruction limits Scout's task. The connector's technical permissions remain broader than that instruction.

You should see Scout say that it has no way to read Calendar. Scout may instead reach Google's sign-in through its own browser.

That blocked read is the intended result. You have proved that Calendar is closed before the connection exists.

If Scout asks you to take over its browser, stop the attempt by sending:

No. Do not sign in there. Stop.

What does this boundary message do?

The message prevents a Google browser session from being stored on Scout's shared computer. The failed read remains your closed-door result.

You should see the browser sign-in attempt stop. No approval card is expected because no Calendar connector action exists yet.

Did Scout read Calendar anyway?

Return to Grok Bot Settings to check for an unknown Calendar connection.
Check Scout's browser for an existing Google session.
Remove any unexpected Calendar connection.
Sign out of any unexpected Google browser session.
Repeat the identical seven-day request until Scout refuses.

Ask for help: Scout read Calendar before I added the intended plugin. Help me trace the existing access without exposing account details.

Connect Calendar and prove the read

The refusal gives you a clean baseline. A purpose-built Google Calendar connection now provides structured event access without storing a Google browser session on Scout's computer.

Why use the Calendar plugin?

The base connection can search and read events for the connected account. Optional write, availability, and calendar-list capabilities are unnecessary for this use case.

Installed connectors serve every Bot on the account. Your narrow tool selection matters even though Scout is the only Bot today.

The provider sign-in is the sensitive moment. Your password stays on Google's own screen and never enters Scout's chat.

Return to Grok Bot Settings from earlier.
Select Plugins.
Choose Add.
Choose Google Calendar.
Continue to Google's provider sign-in screen.
Select the company account.
Enter the company account password only on Google's screen.
Approve the requested permissions for the Calendar read connection.

You should return to Grok Bot Settings with Google Calendar connected to the company account.

Keep Calendar write tools off when that control appears.
Keep the availability tool off when that control appears.
Keep the calendar-list tool off when that control appears.
Confirm that no Gmail plugin is active.
Confirm that no files plugin is active.
Confirm that no sheets plugin is active.

You should see exactly one active plugin named Google Calendar. No second plugin should appear.

Calendar connection missing?

Confirm that the provider sign-in finished on Google's screen. Return to Settings and check whether Google Calendar now appears under Plugins.

Ask for help: Help me check why Google Calendar is missing from Grok Bot Plugins after provider sign-in without asking for my password or account address.

The Admin console check confirms whether company policy permits the intended outside-app access. It also lets you review the requested Calendar service yourself.

Switch back to the Admin console.
Select Menu.
Select Security.
Select Access and data control.
Select API controls.
Select Manage App Access.
Inspect Requested services for Google Calendar.
Inspect the OAuth scopes for the connection.

You should see the current Calendar service policy. The new app entry may already show the requested Calendar access.

Can't see the app details yet?

New app details can take 24 to 48 hours to appear after authorization. Record the current Calendar service policy and the connection outcome without guessing an app name or client ID.

The connection register now needs to replace its no-connection baseline. The row records the service without exposing the real company account address.

Ask Scout to replace the baseline row in /workspace/pineapple/ops/CONNECTIONS.md with this exact row:

Google Calendar | company account | Scout | 2026-09-15 | Day 2 | None while a routine reads it; review Day 98

What does this register row preserve?

The app field names the only connected service.
The account field keeps the real company address out of the file.
The Bot field names Scout as the worker that uses the connection.
The final field schedules the Day 98 review.

Preview /workspace/pineapple/ops/CONNECTIONS.md.
Confirm that the register still has exactly six columns.
Confirm that the baseline row has disappeared.

You should see one Google Calendar row naming Scout. The file should contain no account address or credential.

Register row in the wrong place?

Confirm that Scout replaced the baseline row beneath the existing six headers. The header order must remain unchanged.

Ask for help: Help me compare my six-column connection register with the required Google Calendar row without adding an account address or credential.

✔️ Awesome, I've got everything!

Your register now has its six original headers and one active Google Calendar row.

Confirm that no baseline row remains.
Confirm that no password or account address appears.

ⓧ I'd like to double check the full code

Compare the full register structure with this reference.

App | Account | Bot whose job uses it | Date | Day that needs it | Revoke date
Google Calendar | company account | Scout | 2026-09-15 | Day 2 | None while a routine reads it; review Day 98

What should match?

The header must retain six columns in this order. The Google Calendar row must be the only active connection beneath it.

The register now matches the live connection. The identical Calendar request can reveal whether the new read path works.

Before you repeat the request, do you expect Scout's answer to change now that one read connection exists?

Send Scout the identical seven-day request:

Read my calendar for the next seven days and list the events.

What changes in this second run?

The request stays fixed while the access path changes. A returned event title proves that the Google Calendar plugin handled the read.

Inspect the proposed action if an approval card appears.
Confirm that the proposal covers a Calendar read.
Choose Allow once.

You should see Scout return at least one event title from the next seven days. That title is the visible proof that the structured connection works.

Is the next week empty?

Add your next real deadline to Google Calendar yourself.
Save the event inside the next seven days.
Repeat the identical seven-day request.
Deny any proposal to write to Calendar.
Deny any proposal to use Scout's browser.

Ask for help: Scout cannot return an event title through the Google Calendar plugin. Help me check the read connection and approval scope.

The Plugin check date belongs after the successful read. This ordering proves that the checklist records tested access.

Ask Scout to fill the empty Plugin check area in /workspace/pineapple/ops/WORKSPACE.md.
Require the entry to name Grok Bot Settings > Plugins.
Require the entry to name Google Admin console API controls.
Date the Plugin check entry 2026-09-15 only after the successful event-title read.
Preview the updated checklist.

You should see the Google Calendar plugin check dated after Scout's successful read. The Proof and First booking headings should remain empty.

Return to Grok Bot Settings for the final check.
Confirm that Google Calendar is the only active plugin.
Confirm that Calendar write tools remain off when that control is available.
Confirm that the availability tool remains off when that control is available.
Confirm that the calendar-list tool remains off when that control is available.
Confirm that Scout remains the only Bot.

You should see one Google Calendar connection and no Gmail, files, sheets, or second plugin. Scout has now demonstrated a refusal before connection and one event title after connection.

That's the control boundary proven: you worked every Google setting yourself, while Scout received one tested Calendar read path. Next up, your business-owner friend will use the real Clarity call front door.

Capture the Real Booking

Your Google Calendar door is now narrow and tested. Scout can read events through the plugin.

That connection earns its place when your business-owner friend uses the real front door for a real Clarity call.

You keep control of the booking. Scout records a narrow prep line after the event exists.

In This Step, Get Ready To:

Guide your business-owner friend through a real 30-minute Clarity call booking.
Have Scout read the new booking through the Google Calendar plugin.
Verify the live event against Scout's First booking prep line.

Complete the Real Booking

Your friend creates the booking through the front door you prepared. Your checklist records either a Calendar booking page or the fixed-slot fallback.

✔️ I Have a Booking Page

In the Google Calendar tab from earlier, find your Clarity call under Booking pages.
Hover over the Clarity call booking page.
Select Copy link.
Send the copied link to the friend you messaged first.
Stay with your friend while they book a real 30-minute call.

ⓧ I Used the Fixed-Slot Fallback

In the Gmail tab from earlier, find the fixed weekly Clarity call slot in your company signature.
Send the fixed slot to the friend you messaged first.
Stay with your friend while they reply with their real agreed time.
In the Google Calendar tab from earlier, select the agreed start time.
Enter Clarity call as the event title.
Set the event duration to 30 minutes.
Select Save.

Before you check, do you expect the new event to appear at the same time your friend chose?

Switch back to your Google Calendar tab.
Find the new Clarity call at the agreed time.
Select the event to confirm its 30-minute duration.

You'll see a real Clarity call occupying 30 minutes at the time agreed with your friend.

That is the front door working. Your company Calendar now holds the real call your friend requested.

Ask Scout for the Prep Line

The live event is now the source of truth. Inside Grok Bot, Scout can turn that source into one prep line without changing the booking.

Human approval keeps any unexpected action paused for your decision. Any approval here should cover a Calendar read only.

Give Scout the narrow booking-read request by sending this exact message:

Use only the Google Calendar plugin. Read the new booking. Under the First booking heading in /workspace/pineapple/ops/WORKSPACE.md, write one line with the friend's first name, when, and the one thing they wrote they want clarity on, in their words. If the booking page could not ask the question or the plugin did not return the answer, write first name and when only. Do not include an email address. Do not use the browser.

What Does This Request Protect?

The Google Calendar plugin is Scout's only permitted source for the booking.
The First booking heading keeps the prep line inside /workspace/pineapple/ops/WORKSPACE.md.
The clarity answer appears only when Calendar returns it. This prevents Scout from filling an evidence gap.
The email restriction keeps the operating record limited to the details needed for the call.

Inspect the proposed action if an approval card appears.
Choose Allow once only for a Google Calendar read.
Choose Deny for any browser action.
Choose Deny for any Calendar write action.
Choose Deny for any wider-service action.
Wait for Scout to return the updated file card.

You'll see an updated /workspace/pineapple/ops/WORKSPACE.md file card with one line under First booking.

Select the /workspace/pineapple/ops/WORKSPACE.md file card in Scout's conversation.
Find the line under First booking.
Compare the recorded first name with your business-owner friend's first name.
Compare the recorded time with the live Calendar event.
Compare the clarity answer with the event only when Calendar returned that answer.
Confirm the line contains no email address.
Tell Scout to fix the line in place if any check fails.

The reviewed line now contains the friend's first name plus the real booking time. It also contains the friend's own clarity answer only when Calendar supplied it.

Prep Line Does Not Match?

Check that Scout used the Google Calendar plugin as its source.
Keep the line to the first name plus time when Calendar did not return the booking-form answer.
Remove any email address before accepting the line.

Ask for help: Help me compare Scout's First booking line with the live Google Calendar event without exposing an email address.

Confirm the Read-Only Boundary

One successful read does not expand Scout's job. The live event plus the plugin screen provide the final evidence that this use case stayed narrow.

Before you make the final check, do you expect the live event and prep line to match while the plugin list still shows one read-only connection?

Switch back to the real Clarity call event in Google Calendar.
Compare the friend's first name with the prep line.
Compare the event start time with the prep line.
Confirm the event still lasts 30 minutes.
Switch back to Grok Bot Settings from earlier.
Select Plugins.
Confirm Google Calendar is the only active plugin.
Confirm Calendar write tools remain off if those controls are available.

You'll see matching first-name and time evidence in the event and prep line. Google Calendar remains the only plugin while Gmail, files, and sheets remain disconnected.

That boundary held from start to finish. Scout read the real booking without creating, editing, or accepting anything in Calendar.

Your real Clarity call is booked with a reviewed prep line. Next, you'll audit this result against every live source.

Secret mission

Part 5: Confirm the Output

Scout has written the evidence. Founder control depends on checking that evidence against the live systems yourself. Audit the plugin, booking, files, and plan meter without asking Scout to judge its own work.

Clean Up Your Resources

Choose how the Google Calendar connection should sit after today. You can keep it active, pause Scout's Calendar work, or remove it entirely.

Today's added cost is 0.00 USD because your Grok Bot and Google Workspace plans are already paid for. The Google Calendar plugin is the only addition.

Cost warning

On-demand usage remains off. Today's workflow adds no usage charge.

Enabling on-demand usage later can add cost. The Pause and Delete options prevent new Scout Calendar work when this use case ends.

Resources you used:

One active Google Calendar plugin connection in Grok Bot Settings.
One Google Account authorization for Google Calendar.

Keep everything running

This is today's chosen path. No action is needed while the booking front door or a future routine still needs Calendar.

Leave the Google Calendar plugin connected.
Keep the matched records in /workspace/pineapple/ops/WORKSPACE.md, /workspace/pineapple/ops/CONNECTIONS.md, and /workspace/pineapple/ops/usage.md.
Leave the Auto-review gates active.
Review the connection register on Day 98.

Pause - I'll come back to this later

This option prevents new Calendar work without changing the connection or its evidence.

Assign Scout no Calendar work.
Leave the Google Calendar connection unchanged.
Leave the active row in /workspace/pineapple/ops/CONNECTIONS.md unchanged until review.

Delete - I don't want to use this again

Removing this connection is deliberate. It closes Scout's only door to Calendar.

Your matched records, live booking, and Auto-review gates stay in place.

In Grok Bot Settings from earlier, select Plugins to confirm Google Calendar is the only active connection.
Remove Google Calendar.
In the company Google Account from earlier, open myaccount.google.com/permissions to find the Google Calendar access.
Revoke Google Calendar access.
In /workspace/pineapple/ops/CONNECTIONS.md, replace the active Revoke date entry with the real revocation date.
Return to Plugins to confirm no Google Calendar connection remains.
Refresh myaccount.google.com/permissions to confirm no Google Calendar access remains.
Return to /workspace/pineapple/ops/CONNECTIONS.md to confirm Revoke date shows the real date.

That's the boundary closed cleanly. Scout no longer has Calendar access.

Your register preserves the date that proves when the access ended.

Nice Work!

Excellent work! You built a founder-controlled Clarity call workflow through one read-only Google Calendar plugin. Your matched operating record proves that Scout gained access only after you opened that one door.

You learned how to:

Configured seven founder-owned settings across Google Workspace. Kept Auto-review gates active around risky actions.
Captured Scout's pre-plugin refusal. Confirmed one event title after connecting only Google Calendar through Google's provider sign-in.
Verified a real 30-minute Clarity call booked by your business-owner friend. Matched Scout's prep line to the live Calendar event.
Secret Mission: Audited the matched operating record against the live plugin, booking path, Calendar event, and weekly usage meter. Kept final approval with you.

Ready to quiz yourself?