How We Built a Gmail Whitelist Automation at Arihant — From Hours to Under Two Minutes

How a small IT team automated an unglamorous but painful workflow — with Google Apps Script, Playwright, and an AI pair programmer.

At Arihant Industrial Corporation Ltd., one of the small daily frictions in our Google Workspace environment used to be whitelist requests. An employee needed a vendor's or customer's email domain added to their personal Gmail Address List so legitimate correspondence stopped getting filtered. The ask was mundane. The process was anything but.

A user would email IT with the address. IT would email the user's head of department asking for approval. The HOD would reply with an approval or a question. IT would log in to Google Workspace Admin Console, navigate to Gmail → Manage Address Lists, find the user's list, add the address, save, and reply-all with confirmation. Repeat several times a week across dozens of HODs. Each request took hours of elapsed time and real minutes of IT work. Nothing about it required judgment that IT was uniquely qualified to make — but the Admin Console task required admin credentials.

Multiply that by a growing organization and the inefficiency became hard to ignore.

Why we couldn't just use an API

The obvious engineering answer — write a script against a Google Workspace API — fell apart immediately. Google provides APIs for most admin operations, but Gmail per-user Address Lists specifically do not have one. The Address Lists feature is UI-only inside Admin Console. There was no supported programmatic entry point, and no realistic prospect of one appearing on Google's roadmap.

That left two options: live with the manual process, or automate the UI itself. We chose the second — eyes open to the fact that UI automation against a vendor's console is a long-term commitment because the UI changes, sessions expire, and risk engines score every login.

The solution

What we built is a three-tier system that preserves exactly the same governance as the old process — HOD approval, full audit trail — but removes every manual step.

The front end is a self-service form built with Google Apps Script. An employee fills in the address they need whitelisted plus a one-line justification. The form submits a row to a dedicated Google Sheet that serves as the request queue and audit log. Simultaneously, Apps Script sends the employee's HOD an email with two prominent buttons — Approve and Reject — each one carrying a cryptographically signed URL that only the intended HOD can validly act on. One click records the HOD's decision.

Within 30 seconds of approval, an always-on Python poller running as a Windows service picks up the row, flips its status to "Processing", and hands it to a module that uses Playwright to drive a headed Chromium browser against Google Admin Console. The browser signs in with cookies from a persisted session, navigates to the user's address list, pastes in the new entry, and saves. The sheet row flips to "Completed", the user receives a confirmation email, and the audit log captures every state transition. End-to-end time from HOD click to inbox confirmation: typically under 90 seconds.

The automation runs on a hardened Windows 10 VM, orchestrated as a Windows service via NSSM. The Sophos firewall pins the VM's outbound IP so Google always sees us from the same egress. Every state change writes to the Google Sheet audit log, and failures trigger email alerts to IT within minutes.

The security posture that made it defensible

A browser automation that holds admin credentials would ordinarily make any security team nervous — fairly. We addressed that head-on. The automation uses a dedicated Google account with a custom admin role that grants exactly one privilege: Gmail Settings. Nothing else. The account cannot read anyone's Gmail, cannot manage users, cannot touch Drive. Its password lives only as a Windows environment variable injected by NSSM — never in code, never in a configuration file. Every successful login triggers an alert in Google Admin Alert Center. The account's SAML flow is bypassed via a dedicated OU so re-authentication is deterministic. The attack surface is intentionally tiny, and if something ever did go wrong, the blast radius is limited to Gmail Address Lists only.

The hard parts

The architecture wasn't the hard part. The operational edges were.

Google enforces a one-hour session cap on any account holding an admin role. Our automation had to re-authenticate itself every time that cap tripped, which meant automating Google's own sign-in flow — multiple variants of it, with risk-scored delays that sometimes stretched to thirty seconds between a submitted password and a redirect. Google's gspread Python library sometimes started returning stale sheet reads after days of continuous runtime, requiring a periodic full client rebuild. Browser cookies refreshed by Google during each run had to be written back to disk at the end of each session, otherwise every single request paid the full re-authentication cost instead of just the first one per hour.

Each of these problems had a non-obvious fix, found over evenings of logs and screenshots. This is where AI changed what I could ship. Claude, used as a pair programmer, compressed what would otherwise have been weeks of design and debugging into days. Not because it wrote perfect code — it didn't — but because the loop of "paste a log line, get a hypothesis, try a fix" was fast enough that I could work through five layered failures in a single evening and still eat dinner on time. The human in the loop is still essential — security choices, trade-offs, deployment decisions, when to say no. But the mechanical grind of pattern-matching failures is exactly where AI pays rent.

The impact

The system is now hands-off. Requests that used to take hours to days now complete in under two minutes end-to-end. HODs act in a single tap. IT does zero manual work. Everything is audited in a single sheet, searchable and timestamped. The automation processes requests twenty-four by seven, and the only emails IT receives from it are the ones that actually warrant attention: successful logins (as a security signal) and the rare failure requiring investigation.

Weeks of IT time, back. Hundreds of email threads, replaced. A workflow that used to be a small daily tax on the organization, now invisible.

Automation that compounds.

---

Technology stack: Google Apps Script · Google Sheets · Python 3 · Playwright · Chromium · gspread · NSSM · Windows 10 · Google Workspace Admin Console · Claude (AI pair programmer).

Written by Sushant Naik, Assistant Manager — IT, Arihant Industrial Corporation Ltd.