What permissions does each integration need?

Google Workspace: gmail.settings.basic (read/update signatures), gmail.settings.sharing (org-wide signatures), admin.directory.user.readonly (sync users). Microsoft 365: MailboxSettings.ReadWrite (manage signatures), User.ReadBasic.All (sync users). HubSpot: contacts (read contact data). We never access email content, only signature settings and user directories.