Gmail API - Service Account delegation

Question

I'm looking into using the GMail API to send out emails programtically for one of our systems. I believe I need to create a service account and then set it up with domain-wide-access in order to delegate the email sending ( so the email appears to come from the actual user and not my program ). My question is, if I go this route - is there a way to block out certain users so that the service account cannot "delegate" for them? For example I would like to be able to generate and send emails for our sales team, but I do not want the api to be able to generate any emails for our senior officers.

The flow of things would be....our program gathers info from our database and then loops through this data and uses the gmail api to generate the emails for the sales staff. I'm very new to the google/gmail api and am leery of giving the service account domain-wide-access for delegation.

Is there a "best practice" approach for doing something like this?

Answer 1

Unfortunately it is not possible to restrict domain-wide delegation to only certain users in the admin / cloud console settings

• You user enable DOMAIN-WIDE delegation or no delegation at all
• You can only control porgrammatically who will be impersonated
• One option is to pre-filter your database so that your code is fed only with email addresses of users that you want to impersonate
• Another option would be to implement an if statement that retrieves e.g. the orgUnit for each email and does or does not impersonate the user based on his orgUnit (e.g impersonate only the orgUnit "Sales staff")