61 Config-drift & persistence sentinel (incl. mail-routing watch)

draft

A scheduled job snapshots the settings an attacker changes in order to persist — admin role assignments, domain-wide delegation clients and their scopes, the OAuth allowlist, Gmail routing rules, mail hosts and compliance rules, forwarding, 2SV enforcement — and diffs each run against the last approved baseline. A silent inbound or outbound routing rule is the classic post-compromise persistence, and it is invisible to the user whose mail it copies.

Caveats

The sentinel must run under an identity the attacker cannot silence — a super-admin snapshotter is disabled by the same compromise it is supposed to detect.
Alerting on every diff without a change-approval feed produces pure noise — and noise is what gets the sentinel muted, so the control is the unapproved-delta alert, not the diff.

Setup steps

Write a scheduled snapshotter (Apps Script or GAM in CI) that dumps the persistence-relevant config every run: admin role assignments, domain-wide delegation (DWD) clients, OAuth app allowlist, Gmail routing/forwarding rules, mail hosts, 2SV enforcement.

Cadence

hourly for routing/DWD, daily for the rest
Include the Gmail Routing and Hosts tables in the snapshot (Hosts is its own screen under Gmail > Hosts) — a silent inbound/outbound routing rule is the classic post-compromise persistence.
open ↗

https://admin.google.com/ac/apps/gmail/routing · captured 2026-07-15

Apps › Google Workspace › Gmail › Routing
```
Diff on any add/change to routing, hosts, or compliance rules
```
Add Gmail routing settings Add mail servers for Gmail email routing
Snapshot the DWD client list + scopes; any new client id is an alert.

open ↗

https://admin.google.com/ac/owl/domainwidedelegation · captured 2026-07-15

Security › Access and data control › API controls › Manage Domain Wide Delegation

Any new client id or scope

High severity

Control API access with domain-wide delegation
Diff each run against the last committed baseline and alert on any delta not preceded by an approved change.

Unapproved delta

page

approved delta

auto-commit new baseline

Ongoing maintenance

automatable: script Per schedule: the sentinel run itself.
automatable: AI agent Per run: read the diff and separate deliberate change from drift or persistence.

How to verify

Check the sentinel’s last run is within its schedule, then change a benign monitored setting and confirm the next run flags it. Revert the setting.

Further screens

Admin console screen — Account > Admin roles — https://admin.google.com/ac/list/roles captured 2026-07-15

draft v0.1.2 Detect policy #27 · #12, #33, #34 ↗