A Google Chat AI agent with pairing and approvals.

Google Chat sits inside an organisation's identity system, which changes what people assume about a bot living there. If it is in Workspace, users assume it respects the same boundaries their Drive and Calendar do. An agent that reads from one team's conversation and volunteers it in another's violates an expectation nobody wrote down but everybody has.

Events in, governed runs out

Muster maps Google Chat MESSAGE events into the same SurfaceMessage envelope that the terminal, web, Slack, Telegram, Teams, Discord, and WhatsApp surfaces produce. One envelope means one place where sender identity, active scope, provider route, budget, and tool policy are decided. A Workspace turn is not a special case with its own rules; it is a normal Muster run that happened to arrive from Chat.

The echo guard is not a small detail

Bot messages are ignored so the gateway cannot loop on its own output. This sounds trivial until it happens: an agent replies, the reply arrives as a new message event, the agent replies to itself, and a runaway loop burns tokens at machine speed inside a room full of people watching it happen. Filtering the bot's own authorship at the adapter is the cheap fix, and it belongs there rather than in a prompt.

Approvals belong in the room, not in a terminal

Gates can render as Chat cards with approve and reject actions, which puts the decision where the accountable person actually is. An approval flow that requires someone to SSH into a box is an approval flow that gets rubber-stamped or bypassed. Pairing works the same way: an unpaired sender receives an operator approval code before the agent acts on their behalf, so being in the Workspace is not by itself authorisation to spend the agent's budget or reach its tools.

Same memory, same ledger, same policy

Workspace turns share the memory lanes, token ledger, MCP policy, and tool setup checks that the CLI uses. Memory is scoped by tenant, workspace, user, role, and session, so what the agent learned in one room is not automatically retrievable in another. Usage, estimated cost, and replay waste are recorded locally per run rather than read back out of a provider dashboard. If a run touched a repository, its file changes were derived from git and the filesystem rather than taken from the agent's self-report — measured live, that self-report channel reported zero of five real edits.

How file changes are observed -> ERPNext AI agent -> Gateway docs ->