← All integrationsINTEGRATION · IDENTITY

Kapālins for Google

People and groups from Google Workspace. Every plane of Kapālins, the gateway, the workspace and the laptop, knows who the person is, which group they belong to and which policy applies to them.

See it governed liveSetup in four steps

Policy by group, not by spreadsheet

Roles and AI entitlements follow the groups you already keep in Google. Move a person and their access moves with them.

Leave once, lose access everywhere

De-provisioning in Google removes the person from the gateway, the workspace and the device plane in the same sweep.

One identity across planes

Gateway verdicts, workspace sessions and device events all name the same person, so an incident reads as one story.

WHO

Every verdict names a person.

Because people and groups arrive from Google, every row in the timeline carries a person and a group, not an API key or a username string.

  • SCIM 2.0 keeps people and groups current
  • Only people assigned to the Kapālins app are imported
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
NON-HUMAN

The identities no directory holds.

Google brings the people. Agents and service keys are in no directory, so Kapālins profiles each one from its own behaviour, flags the ones that drift, and shows the score line by line, beside the people Google provides.

  • Calls, hours, models and injection rate against baseline
  • Quarantine a key in one click, reversibly
Kapālins Agentic Behaviour: an agent key flagged, with its score derivation and behavioural fingerprint
Console replay · illustrative data
A replay of the Kapālins console: an agent flagged for injection activity, its score explained line by line, its fingerprint against baseline, and the MCP calls it made outside its declared scope. Agent names and activity are illustrative.
ACT

The person, not a guess.

An incident names who did it and which group policy applied, so the review is a conversation with one person, not a hunt through logs.

  • Roles in Kapālins assigned from your groups
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
Setup

Four steps.

  1. Create the SSO appAdd Kapālins as an OIDC application in Google and enter its client details in Kapālins.
  2. Turn on SCIMCreate a provisioning token in Kapālins and paste it into the app’s provisioning settings.
  3. Map groups to rolesChoose which groups become owners, administrators, analysts and members.
  4. Assign the appOnly people assigned to the Kapālins app are imported.
Request a briefing

See Google governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins write to my directory?

No. Provisioning flows one way, from your directory to Kapālins, and any grant sweep is read-only.

Which groups should I provision?

Only the groups that should use Kapālins. Assign the Kapālins app in Google to those groups and SCIM sends exactly them.

What happens when someone leaves?

The next SCIM push deactivates them, and every plane stops recognising their identity.