Question 1

Why does the iam.allowedPolicyMemberDomains error happen?

Accepted Answer

Google Workspace organizations have a default policy called Domain Restricted Sharing that prevents adding IAM members from outside your organization. The gmail-api-push@system.gserviceaccount.com service account is owned by Google, not your org, so the policy blocks it -- even though Gmail Pub/Sub requires this exact binding to function. The fix is overriding the policy at the project level in the GCP Console (not the Workspace Admin Console), granting the binding, then re-tightening the policy.

Question 2

Can I fix this in the Google Workspace Admin Console?

Accepted Answer

No. The iam.allowedPolicyMemberDomains constraint is a Google Cloud Organization Policy, managed exclusively through the GCP Console at console.cloud.google.com. The Workspace Admin Console at admin.google.com has a "Google Cloud session control" page that looks related but controls an entirely different setting. This is the #1 source of wasted debugging time.

Question 3

Is it safe to set allowAll on the org policy?

Accepted Answer

Yes, temporarily. Set the override at the project level (not the organization level), grant the gmail-api-push service account its Publisher role, then immediately re-tighten the policy with gcloud org-policies reset. Existing IAM bindings are not retroactively removed -- the policy only checks at binding creation time. The window of exposure is seconds, not permanent.

Question 4

What if I can't change the org policy?

Accepted Answer

Use heartbeat polling as a fallback. Set up a cron job that runs gog gmail search every 5 minutes. You lose real-time latency (0-5 minute delay instead of 30 seconds) and use more API quota, but it works on every Google Workspace setup without any GCP configuration beyond OAuth. Many OpenClaw deployments run successfully on polling alone.

Tag: oauth