Gmail sending limits and API scopes for AI agents

An agent sending through a Gmail account hits the account's limits: 500 emails a day on personal Gmail and 2,000 on Google Workspace, then a block of up to 24 hours. Through the Gmail API each send costs 100 quota units, and reading mail needs restricted scopes that public apps must pass Google's verification and a yearly security assessment to use. Mail an agent sends for your product belongs on your own domain.

Unitpost · November 2, 2026

Connecting an agent to a Gmail account is the quickest way to let it send: one OAuth consent and it writes as you. It's also where agents run into limits built for one person typing, not a loop that sends.

What are Gmail's sending limits?

Per account, from Google's own pages:

Personal Gmail: 500 emails a day, or 500 recipients in a single email. Past that the account sees "You have reached a limit for sending mail" and can usually send again within 1 to 24 hours (Gmail sending limits).
Google Workspace, per user: 2,000 messages a day (1,500 for mail merge, 500 on a trial account); 2,000 recipients per message, at most 500 of them external, and 500 for a message sent through the Gmail API; 10,000 recipients a day in total, 3,000 of them external. Over a limit, sending is blocked for up to 24 hours (Workspace sending limits).

The block is per account, not per agent. When an agent burns the day's limit at 10 a.m., the person who owns the mailbox can't send either.

What does the Gmail API cost in quota?

The Gmail API counts quota units, not messages. messages.send costs 100 units, messages.get 20 (60 for the full or raw message) and messages.list 5. A project gets 6,000 units a minute per user, so one user's agent can send at most 60 messages a minute before reading anything, and 1,200,000 units a minute across the project. For Cloud projects created from 1 May 2026, usage over 80,000,000 units a day per project is billed (Gmail API quota).

The account's daily sending limits above still apply on top of the API quota.

Which Gmail scopes does an agent need, and what review comes with them?

What the agent does decides the scope, and the scope decides Google's review (Gmail API scopes):

Send only: gmail.send is a sensitive scope. A public app needs Google's verification.
Read, draft or label mail: gmail.readonly, gmail.compose, gmail.modify, gmail.metadata and full access (https://mail.google.com/, which also covers IMAP, SMTP and POP) are restricted. A public app that stores or transmits that data from its servers must pass verification and a security assessment, repeated every 12 months (restricted scope verification).
Exempt: personal-use apps with fewer than 100 users, and apps internal to one Workspace organization.

An agent that answers replies needs to read the inbox, so it needs a restricted scope, and with it access to everything else in that mailbox: invoices, password resets, the CEO's thread.

One mailbox, one blast radius

A prompt injection in an inbound email runs with whatever the agent's scope allows. With full Gmail access, that is the whole mailbox (how to defend against it).

What should an agent send from instead?

For mail your product or business sends, give the agent its own address on a domain you control, such as agent@mail.example.com:

Sending goes through an email API with a key that can only send (which permissions). The domain's SPF, DKIM and DMARC are yours, so receivers can authenticate the mail.
Replies arrive at that address and reach the agent as webhooks, without access to anyone's mailbox (set it up).
Limits are the sending plan's, not a person's account, and a stuck agent can be stopped by revoking one key without touching anyone's email.

Keep a person's Gmail for agents that act as that person, for that person: drafting their replies, sorting their inbox. That's the job OAuth to a mailbox is for.

Frequently asked questions

How many emails can an agent send from a Gmail account a day?

Personal Gmail allows 500 emails a day, or 500 recipients in one email. Google Workspace allows 2,000 messages a day per user (1,500 for mail merge, 500 on a trial), with at most 10,000 recipients a day, 3,000 of them external.

What happens when an agent hits the Gmail limit?

Sending stops with "You have reached a limit for sending mail". Personal accounts can usually send again within 1 to 24 hours; Workspace blocks sending for up to 24 hours. Every message the agent tries in the meantime fails, including the ones a person sends from the same account.

Does sending through the Gmail API need a security assessment?

gmail.send alone is a sensitive scope: it needs Google's app verification but not the assessment. Reading, drafting or modifying mail (gmail.readonly, gmail.compose, gmail.modify or full access) uses restricted scopes, and a public app that stores or transmits that data from its servers needs a security assessment every 12 months. Personal-use apps under 100 users and Workspace internal apps are exempt from verification.

Can an agent send as a Gmail address through another provider?

Not in a way receivers trust. A provider can't sign mail with DKIM for gmail.com, and gmail.com's DMARC policy tells receivers what to do with mail that fails, so it lands in spam or bounces. Send from a domain you control.