Gmail delegation feature allows inbox access without passwords

A Gmail feature known as delegation can allow third parties to access an inbox without requiring the owner's password or bypassing two-factor authentication. While designed for legitimate uses, such as allowing an assistant or colleague to manage an inbox, the permission does not automatically expire and can remain active indefinitely if not manually revoked.

Delegates can read, send, and delete messages. In personal Gmail accounts, users may lack visibility into whether a delegate has accessed their messages, as the Last account activity page does not record delegate sessions. Furthermore, if certain settings are enabled, a delegate can browse an inbox without leaving “unread” indicators.

To manage these permissions, users should navigate to Gmail settings on a computer, select ‘See all settings’, and check the ‘Accounts and Import’ tab. Under the ‘Grant access to your account’ section, users can identify and remove any unauthorized or outdated delegates.