---
name: pp-workspace-admin
description: "GAT-style Google Workspace auditing as an agent-native CLI: sync Directory, Drive, Gmail, Reports, and Alert Center into a local store, then run offline cross-API audits, offboarding, and OAuth-app risk checks that GAM and the official gws CLI cannot persist. Trigger phrases: `offboard a user`, `audit external Drive sharing`, `which OAuth apps have Full Drive access`, `show me this user's security posture`, `reconstruct this account's activity`, `use workspace-admin`, `run workspace-admin`."
author: "RyanGravetteIDLA"
license: "Apache-2.0"
argument-hint: "<command> [args] | install cli|mcp"
allowed-tools: "Read Bash"
metadata:
  openclaw:
    requires:
      bins:
        - workspace-admin-pp-cli
    install:
      - kind: go
        bins: [workspace-admin-pp-cli]
        module: github.com/mvanhorn/printing-press-library/library/productivity/workspace-admin/cmd/workspace-admin-pp-cli
---
<!-- GENERATED FILE — DO NOT EDIT.
     This file is a verbatim mirror of library/productivity/workspace-admin/SKILL.md,
     regenerated post-merge by tools/generate-skills/. Hand-edits here are
     silently overwritten on the next regen. Edit the library/ source instead.
     See the repository agent guide, section "Generated artifacts: registry.json, cli-skills/". -->

# Google Workspace Admin — Printing Press CLI

## Prerequisites: Install the CLI

This skill drives the `workspace-admin-pp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first:

1. Install via the Printing Press installer. It defaults binaries to `$HOME/.local/bin` on macOS/Linux and `%LOCALAPPDATA%\Programs\PrintingPress\bin` on Windows:
   ```bash
   npx -y @mvanhorn/printing-press-library install workspace-admin --cli-only
   ```
2. Verify: `workspace-admin-pp-cli --version`
3. Ensure the reported install directory is on `$PATH` for the agent/runtime that will invoke this skill.

If the `npx` install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.4 or newer). This installs into `$GOPATH/bin` (default `$HOME/go/bin`), so add that directory to `$PATH` instead:

```bash
go install github.com/mvanhorn/printing-press-library/library/productivity/workspace-admin/cmd/workspace-admin-pp-cli@latest
```

If `--version` reports "command not found" after install, the runtime cannot see the binary directory on `$PATH`. Do not proceed with skill commands until verification succeeds.

A curated Google Workspace admin and audit tool built on the Admin SDK (Directory, Reports, Alert Center), Drive, and Gmail. Unlike stateless tools, it syncs Workspace metadata into a local SQLite store so audits like audit external-shares, audit app-risk, and audit user360 run offline and join data across APIs. workflow offboard executes a departing user's full lifecycle in one command, and every command is agent-native with --json, --select, --dry-run, and typed exit codes.

## When to Use This CLI

Use this CLI for GAT-style Google Workspace auditing and lifecycle automation: offboarding departing users, auditing external Drive sharing, scoring third-party OAuth app risk, reviewing login anomalies and dormant accounts, reconstructing a compromised account's activity, and producing offline cross-API reports over Directory, Drive, Gmail, Reports, and Alert Center. It is the right choice when you want joinable, persisted audit data that stateless tools like GAM and the official gws CLI do not keep.

## Anti-triggers

Do not use this CLI for:
- Do not use this CLI for real-time browser DLP, keyword interception, screenshots, or on-screen blocking — those require GAT Shield's Chrome endpoint extension and have no Google API equivalent.
- Do not use this CLI as a mail-flow gateway to block phishing before delivery; it performs post-hoc metadata audit and remediation, not pre-inbox filtering.
- Do not use this CLI to read another user's file or email contents without a service account configured for domain-wide delegation and impersonation.
- Do not use this CLI for Google Cloud / IAM resource management — use gcloud; this tool manages Google Workspace, not GCP.

## Unique Capabilities

These capabilities aren't available in any other tool for this API.

### Lifecycle workflows that compound
- **`workflow offboard`** — Run a departing user's entire lifecycle in one command — suspend, sign out, revoke OAuth tokens, transfer Drive ownership, set Gmail delegation, remove from groups, and move to a suspended OU.

  _Reach for this instead of running eight separate endpoint commands when a user leaves; it guarantees no step is skipped and records what completed._

  ```bash
  workspace-admin-pp-cli workflow offboard departing@example.com --manager manager@example.com --dry-run
  ```

### Cross-API audits only the local store enables
- **`audit user360`** — One per-user posture report joining the user's Drive footprint and quota, security (2SV, suspended), connected OAuth apps, devices, Gmail settings, group memberships, and recent activity.

  _Pick this to answer 'what is going on with this account' in one call instead of stitching five APIs together._

  ```bash
  workspace-admin-pp-cli audit user360 user@example.com --agent --select security,apps,devices
  ```
- **`audit external-shares`** — Find every Drive file shared 'anyone with link' or with an external domain, joined to its owner and the owner's org unit.

  _Use this for the domain-wide external Drive exposure sweep; for one user's Drive footprint use audit user360._

  ```bash
  workspace-admin-pp-cli audit external-shares --domain gmail.com --agent --select files.name,files.owner,files.permissions.emailAddress
  ```
- **`audit reconstruct`** — Merge one user's login, admin, Drive, and token activity into a single ordered timeline for post-compromise review.

  _Pick this after a suspected compromise to see everything an account did in order; for domain-wide anomalies use audit logins._

  ```bash
  workspace-admin-pp-cli audit reconstruct user@example.com --since 7d --agent
  ```
- **`audit email-exposure`** — Sweep every user's Gmail forwarding, sendAs, delegates, and filters for external forwarding, external send-as, delegates, and forward/delete rules — the standard business-email-compromise indicators.

  _Use this for the domain-wide BEC sweep of forwarding rules, delegates, and suspicious filters; for one user's full email settings use audit user360._

  ```bash
  workspace-admin-pp-cli audit email-exposure --agent --select findings.user,findings.type,findings.detail
  ```

### Security posture
- **`audit app-risk`** — Roll up every third-party OAuth app authorized in the domain by a curated scope-to-risk tier (Low/Moderate/High), flag apps with Full Drive access, and count users-per-app with the member list.

  _Reach for this during third-party app review to rank risk and find which users authorized a dangerous app._

  ```bash
  workspace-admin-pp-cli audit app-risk --min-risk high --agent
  ```
- **`audit logins`** — Surface failed-login bursts, new-country logins, and dormant accounts (no login since N days) from synced login activity joined to users.

  _Use this for the weekly login-anomaly and dormant-account review; for a single user's forensic timeline use audit reconstruct._

  ```bash
  workspace-admin-pp-cli audit logins --failures --geo --since 7d --agent
  ```

### Local state that compounds
- **`groups expand`** — Recursively flatten nested groups into their effective direct-user membership, cycle-safe.

  _Use this to answer 'who is effectively in this group' before an access decision; to list one user's group memberships use audit user360._

  ```bash
  workspace-admin-pp-cli groups expand all-staff@example.com --agent --select members.email,members.viaGroup
  ```

## Command Reference

**admin** — Manage admin

- `workspace-admin-pp-cli admin channels-stop` — Stops watching resources through this channel.
- `workspace-admin-pp-cli admin customer-devices-chromeos-commands-get` — Gets command data a specific command issued to the device.
- `workspace-admin-pp-cli admin customer-devices-chromeos-issue-command` — Issues a command for the device to execute.
- `workspace-admin-pp-cli admin customers-chrome-print-servers-batch-create-print-servers` — Creates multiple print servers.
- `workspace-admin-pp-cli admin customers-chrome-print-servers-batch-delete-print-servers` — Deletes multiple print servers.
- `workspace-admin-pp-cli admin customers-chrome-print-servers-create` — Creates a print server.
- `workspace-admin-pp-cli admin customers-chrome-print-servers-delete` — Deletes a print server.
- `workspace-admin-pp-cli admin customers-chrome-print-servers-get` — Returns a print server's configuration.
- `workspace-admin-pp-cli admin customers-chrome-print-servers-list` — Lists print server configurations.
- `workspace-admin-pp-cli admin customers-chrome-print-servers-patch` — Updates a print server's configuration.
- `workspace-admin-pp-cli admin customers-chrome-printers-batch-create-printers` — Creates printers under given Organization Unit.
- `workspace-admin-pp-cli admin customers-chrome-printers-batch-delete-printers` — Deletes printers in batch.
- `workspace-admin-pp-cli admin customers-chrome-printers-create` — Creates a printer under given Organization Unit.
- `workspace-admin-pp-cli admin customers-chrome-printers-list` — List printers configs.
- `workspace-admin-pp-cli admin customers-chrome-printers-list-printer-models` — Lists the supported printer models.
- `workspace-admin-pp-cli admin directory-asps-delete` — Deletes an ASP issued by a user.
- `workspace-admin-pp-cli admin directory-asps-get` — Gets information about an ASP issued by a user.
- `workspace-admin-pp-cli admin directory-asps-list` — Lists the ASPs issued by a user.
- `workspace-admin-pp-cli admin directory-chromeosdevices-action` — Takes an action that affects a Chrome OS Device. This includes deprovisioning, disabling, and re-enabling devices.
- `workspace-admin-pp-cli admin directory-chromeosdevices-get` — Retrieves a Chrome OS device's properties.
- `workspace-admin-pp-cli admin directory-chromeosdevices-list` — Retrieves a paginated list of Chrome OS devices within an account.
- `workspace-admin-pp-cli admin directory-chromeosdevices-move-devices-to-ou` — Moves or inserts multiple Chrome OS devices to an organizational unit. You can move up to 50 devices at once.
- `workspace-admin-pp-cli admin directory-chromeosdevices-patch` — Updates a device's updatable properties, such as `annotatedUser`, `annotatedLocation`, `notes`, `orgUnitPath`
- `workspace-admin-pp-cli admin directory-chromeosdevices-update` — Updates a device's updatable properties, such as `annotatedUser`, `annotatedLocation`, `notes`, `orgUnitPath`
- `workspace-admin-pp-cli admin directory-customers-get` — Retrieves a customer.
- `workspace-admin-pp-cli admin directory-customers-patch` — Patches a customer.
- `workspace-admin-pp-cli admin directory-customers-update` — Updates a customer.
- `workspace-admin-pp-cli admin directory-domain-aliases-delete` — Deletes a domain Alias of the customer.
- `workspace-admin-pp-cli admin directory-domain-aliases-get` — Retrieves a domain alias of the customer.
- `workspace-admin-pp-cli admin directory-domain-aliases-insert` — Inserts a domain alias of the customer.
- `workspace-admin-pp-cli admin directory-domain-aliases-list` — Lists the domain aliases of the customer.
- `workspace-admin-pp-cli admin directory-domains-delete` — Deletes a domain of the customer.
- `workspace-admin-pp-cli admin directory-domains-get` — Retrieves a domain of the customer.
- `workspace-admin-pp-cli admin directory-domains-insert` — Inserts a domain of the customer.
- `workspace-admin-pp-cli admin directory-domains-list` — Lists the domains of the customer.
- `workspace-admin-pp-cli admin directory-groups-aliases-delete` — Removes an alias.
- `workspace-admin-pp-cli admin directory-groups-aliases-insert` — Adds an alias for the group.
- `workspace-admin-pp-cli admin directory-groups-aliases-list` — Lists all aliases for a group.
- `workspace-admin-pp-cli admin directory-groups-delete` — Deletes a group.
- `workspace-admin-pp-cli admin directory-groups-get` — Retrieves a group's properties.
- `workspace-admin-pp-cli admin directory-groups-insert` — Creates a group.
- `workspace-admin-pp-cli admin directory-groups-list` — Retrieves all groups of a domain or of a user given a userKey (paginated).
- `workspace-admin-pp-cli admin directory-groups-patch` — Updates a group's properties. This method supports [patch semantics](/admin-sdk/directory/v1/guides/performance#patch).
- `workspace-admin-pp-cli admin directory-groups-update` — Updates a group's properties.
- `workspace-admin-pp-cli admin directory-members-delete` — Removes a member from a group.
- `workspace-admin-pp-cli admin directory-members-get` — Retrieves a group member's properties.
- `workspace-admin-pp-cli admin directory-members-has-member` — Checks whether the given user is a member of the group.
- `workspace-admin-pp-cli admin directory-members-insert` — Adds a user to the specified group.
- `workspace-admin-pp-cli admin directory-members-list` — Retrieves a paginated list of all members in a group. This method times out after 60 minutes.
- `workspace-admin-pp-cli admin directory-members-patch` — Updates the membership properties of a user in the specified group.
- `workspace-admin-pp-cli admin directory-members-update` — Updates the membership of a user in the specified group.
- `workspace-admin-pp-cli admin directory-mobiledevices-action` — Takes an action that affects a mobile device. For example, remotely wiping a device.
- `workspace-admin-pp-cli admin directory-mobiledevices-delete` — Removes a mobile device.
- `workspace-admin-pp-cli admin directory-mobiledevices-get` — Retrieves a mobile device's properties.
- `workspace-admin-pp-cli admin directory-mobiledevices-list` — Retrieves a paginated list of all user-owned mobile devices for an account.
- `workspace-admin-pp-cli admin directory-orgunits-delete` — Removes an organizational unit.
- `workspace-admin-pp-cli admin directory-orgunits-get` — Retrieves an organizational unit.
- `workspace-admin-pp-cli admin directory-orgunits-insert` — Adds an organizational unit.
- `workspace-admin-pp-cli admin directory-orgunits-list` — Retrieves a list of all organizational units for an account.
- `workspace-admin-pp-cli admin directory-orgunits-patch` — Updates an organizational unit. This method supports [patch semantics](/admin-sdk/directory/v1/guides/performance#patch)
- `workspace-admin-pp-cli admin directory-orgunits-update` — Updates an organizational unit.
- `workspace-admin-pp-cli admin directory-privileges-list` — Retrieves a paginated list of all privileges for a customer.
- `workspace-admin-pp-cli admin directory-resources-buildings-delete` — Deletes a building.
- `workspace-admin-pp-cli admin directory-resources-buildings-get` — Retrieves a building.
- `workspace-admin-pp-cli admin directory-resources-buildings-insert` — Inserts a building.
- `workspace-admin-pp-cli admin directory-resources-buildings-list` — Retrieves a list of buildings for an account.
- `workspace-admin-pp-cli admin directory-resources-buildings-patch` — Patches a building.
- `workspace-admin-pp-cli admin directory-resources-buildings-update` — Updates a building.
- `workspace-admin-pp-cli admin directory-resources-calendars-delete` — Deletes a calendar resource.
- `workspace-admin-pp-cli admin directory-resources-calendars-get` — Retrieves a calendar resource.
- `workspace-admin-pp-cli admin directory-resources-calendars-insert` — Inserts a calendar resource.
- `workspace-admin-pp-cli admin directory-resources-calendars-list` — Retrieves a list of calendar resources for an account.
- `workspace-admin-pp-cli admin directory-resources-calendars-patch` — Patches a calendar resource.
- `workspace-admin-pp-cli admin directory-resources-calendars-update` — Updates a calendar resource.
- `workspace-admin-pp-cli admin directory-resources-features-delete` — Deletes a feature.
- `workspace-admin-pp-cli admin directory-resources-features-get` — Retrieves a feature.
- `workspace-admin-pp-cli admin directory-resources-features-insert` — Inserts a feature.
- `workspace-admin-pp-cli admin directory-resources-features-list` — Retrieves a list of features for an account.
- `workspace-admin-pp-cli admin directory-resources-features-patch` — Patches a feature.
- `workspace-admin-pp-cli admin directory-resources-features-rename` — Renames a feature.
- `workspace-admin-pp-cli admin directory-resources-features-update` — Updates a feature.
- `workspace-admin-pp-cli admin directory-role-assignments-delete` — Deletes a role assignment.
- `workspace-admin-pp-cli admin directory-role-assignments-get` — Retrieves a role assignment.
- `workspace-admin-pp-cli admin directory-role-assignments-insert` — Creates a role assignment.
- `workspace-admin-pp-cli admin directory-role-assignments-list` — Retrieves a paginated list of all roleAssignments.
- `workspace-admin-pp-cli admin directory-roles-delete` — Deletes a role.
- `workspace-admin-pp-cli admin directory-roles-get` — Retrieves a role.
- `workspace-admin-pp-cli admin directory-roles-insert` — Creates a role.
- `workspace-admin-pp-cli admin directory-roles-list` — Retrieves a paginated list of all the roles in a domain.
- `workspace-admin-pp-cli admin directory-roles-patch` — Patches a role.
- `workspace-admin-pp-cli admin directory-roles-update` — Updates a role.
- `workspace-admin-pp-cli admin directory-schemas-delete` — Deletes a schema.
- `workspace-admin-pp-cli admin directory-schemas-get` — Retrieves a schema.
- `workspace-admin-pp-cli admin directory-schemas-insert` — Creates a schema.
- `workspace-admin-pp-cli admin directory-schemas-list` — Retrieves all schemas for a customer.
- `workspace-admin-pp-cli admin directory-schemas-patch` — Patches a schema.
- `workspace-admin-pp-cli admin directory-schemas-update` — Updates a schema.
- `workspace-admin-pp-cli admin directory-tokens-delete` — Deletes all access tokens issued by a user for an application.
- `workspace-admin-pp-cli admin directory-tokens-get` — Gets information about an access token issued by a user.
- `workspace-admin-pp-cli admin directory-tokens-list` — Returns the set of tokens specified user has issued to 3rd party applications.
- `workspace-admin-pp-cli admin directory-two-step-verification-turn-off` — Turns off 2-Step Verification for user.
- `workspace-admin-pp-cli admin directory-users-aliases-delete` — Removes an alias.
- `workspace-admin-pp-cli admin directory-users-aliases-insert` — Adds an alias.
- `workspace-admin-pp-cli admin directory-users-aliases-list` — Lists all aliases for a user.
- `workspace-admin-pp-cli admin directory-users-aliases-watch` — Watches for changes in users list.
- `workspace-admin-pp-cli admin directory-users-delete` — Deletes a user.
- `workspace-admin-pp-cli admin directory-users-get` — Retrieves a user.
- `workspace-admin-pp-cli admin directory-users-insert` — Creates a user.
- `workspace-admin-pp-cli admin directory-users-list` — Retrieves a paginated list of either deleted users or all users in a domain.
- `workspace-admin-pp-cli admin directory-users-make` — Makes a user a super administrator.
- `workspace-admin-pp-cli admin directory-users-patch` — Updates a user using patch semantics.
- `workspace-admin-pp-cli admin directory-users-photos-delete` — Removes the user's photo.
- `workspace-admin-pp-cli admin directory-users-photos-get` — Retrieves the user's photo.
- `workspace-admin-pp-cli admin directory-users-photos-patch` — Adds a photo for the user. This method supports [patch semantics](/admin-sdk/directory/v1/guides/performance#patch).
- `workspace-admin-pp-cli admin directory-users-photos-update` — Adds a photo for the user.
- `workspace-admin-pp-cli admin directory-users