Secret Manager & Agent Setup

I have a Google Cloud Secret Manager already holding the service-account credentials for my Open Claw agent. The service account itself is in place and the OAuth 2.0 consent screen is fully configured; what’s left is wiring everything together so the agent can actually reach my Gmail, Google Drive and any other standard Google Workspace apps it needs.

Here’s the last mile I need help with:
• Bind the existing service account to the correct scopes so the agent receives read-and-write privileges on Gmail and Drive.
• Confirm the secret is exposed to Open Claw in the format it expects (environment variable or mounted file, whichever you recommend).
• Walk me through a quick verification test—sending a sample email and creating a test file on Drive—to prove the permissions are live.

I estimate the whole thing should take no more than 30 minutes on a screenshare. You’ll be free to use gcloud CLI or the Cloud Console; just make sure the end state is clean, auditable, and uses best-practice IAM roles rather than broad owner rights.