Guide to Actor in xFanatical Foresight

This article is written for Google Workspace Administrators.

Supported plan: xFanatical Foresight Elite plan

Introduction to Actor: Who performs the action

The Actor field lets you choose a user account other than the Google account you connected to xFanatical Foresight, and the automation runs on behalf of that user. 

After you set up a service account, xFanatical Foresight can automate IT workflows on behalf of your users in your Google Workspace organization. The Actor field decides whose calendar, mailbox or files the automation works with, and whose name appears on the changes xFanatical Foresight makes. You choose the actor for each trigger and action in a rule. Each trigger and action can have a different actor, for example the trigger can act as yourself and an action as another user.


The Actor field in the Create Gmail label action, allowing Google Workspace admins to automate workflows on their own Google account or another user in the organization

New triggers and actions act as yourself by default. You can change the actor at any time while editing a rule. 

Actor Availability

The Actor field is only available after the service account is set up. Otherwise, you only see a Connect with Google button for the trigger or action. 


The Connect with Google button is shown if the Actor field is not available for a Google calendar service related action

Not every trigger or action supports the Actor feature. If you have set up the service account but still don't see the Actor field, that trigger or action doesn't support it. Such triggers and actions can only be automated as your connected Google account, and only if they are related to a Google service.

The following sections assume the Actor field is available and describe how to use the Actor feature.New triggers and actions act as yourself by default. You can change the actor at any time while editing a rule.

Automate as Your Own Google Account

xFanatical Foresight defaults to running automations as your connected Google account when you select a Google service-related trigger or action while editing an automation rule. The trigger or action uses your own Google account, so it works with your calendar, mailbox and files, just as if you did the work by hand.

Demo

Instructions

1. Sign into xFanatical Foresight.
2. Go to the Rules page and click to create or edit a rule.
3. On the trigger or action, click the Actor field.
4. Under Act as yourself, select your Google account. 
5. If you see Grant permissions to act as yourself, click Connect with Google.
6. On the Google sign-in page, allow the requested access. After you grant the permissions, you will see Access granted or Access permissions granted by your Google account.
7. Now save the rule.

Notes

• xFanatical Foresight asks for permissions as you add triggers and actions. You may be asked to authorize more than once.
• If your organization restricts third-party apps, a Google admin may need to whitelist xFanatical Foresight in Google Admin console first.
• The rule keeps working only while your Google account is connected. If you change your password, disconnect xFanatical Foresight, or leave the organization, the rule may stop. To keep it running regardless, act as another user through a service account.

Automate on Behalf of Users in Google Workspace

As a Google Workspace administrator, you can build rules that act as other users in your domain. This is called impersonation. For example, a rule can add an event to a new hire's calendar, or read a colleague's agenda, without that person signing into xFanatical Foresight or approving anything.

Impersonation uses your organization's service account. The service account has permission, through Domain Wide Delegation, to act as users in your domain for the specific scopes you authorize.

Demo

Prerequisites 

• xFanatical Foresight active Elite Plan.
• You are a Google Workspace administrator with the Users > Read, Domain Management and Reports privilege. If you're a Super Admin, you have all these privileges.
• Service Account with the Ready state. See Create Service Account.

Allowed Users to Act As

To act as another user in your Google Workspace organization, the selected user must meet these conditions:

• Only users in your organization's domain(s). External users are not allowed. Consumer gmail.com accounts are not allowed.
• Only active users. Suspended, archived or deleted users are not allowed.

When the selected user does not meet the conditions, the workflow automation fails on the given action, or the rule is disabled if the Actor is in the trigger.

Instructions

1. Sign into xFanatical Foresight.
2. Go to the Rules page and click to create a rule.
3. On the Select a trigger or Select an action screen, select the trigger or action you want to run on behalf of another user in your organization.
4. Click the Actor field. Under Act as another user in your Google Workspace organization, choose who to act as:
   1. A specific user: Enter at least 3 characters of the user's name or email address, then select them under Domain users. Use this when the rule should always act as the same person, for example the owner of a shared calendar.
   2. A variable: select a variable under Variables that holds the user's primary email, for example User Created => User Primary Email. Use this when the user is only known when the rule runs, for example whoever the trigger event is about.
5. If an error displays in the Actor field, hover over and follow the steps to grant the missing permissions.
6. When errors are resolved, configure the rest of the trigger or action, then save the rule.
7. Execute the rule and go to the Logs page to check the rule execution summary.

Troubleshooting Guide

Having trouble with the Actor field, or a rule that acts as another user? See the Service Account and Actor Troubleshooting Guide.

Frequently Asked Questions

• What is the Actor?
  The Actor is the user account (identity) whose activity starts an automation, or that an automation action runs as. It can be your own Google account, or another user in your Google Workspace organization.
  
• What does impersonation mean in the Actor?
  xFanatical Foresight acting as another user in your Google Workspace organization, through the service account you set up. The impersonated user doesn't need to sign in or give consent.
  
• Who can act as other users?
  Google Workspace administrators on the Elite plan with the Users > Read, Domain Management and Reports privilege, once a service account is set up and Ready.
  
• Do I need a service account to act as myself?
  No. Acting as yourself only needs your connected Google account.
  
• Can every trigger and action act as another user?
  No. Only supported triggers and actions show the Act as another user in your Google Workspace organization option, e.g. the Create Gmail label action.
  
• Can I use different actors in the same rule?
  Yes. Each trigger and action has its own Actor field. For example, the trigger can act as yourself and an action can act as another user. This allows a Google Workspace administrator to chain actions across different users in one automation. For example, the automation can create a Drive folder as User A, schedule a Calendar event as User B, and send a Gmail message as User C.
  
• Can I act as external users, such as gmail.com accounts?
  No. As a Google Workspace administrator, you can only act as active users in your Google Workspace organization. External users are not supported.
  
• Can I act as a suspended or archived user?
  No. The user must be active. If a user becomes suspended or archived, automations fail with reasons given.
  
• How do I make a rule act as a different user each time it runs? 
  Select a variable in the Actor field instead of a specific user. xFanatical Foresight then acts as the user whose email that variable holds each time the automation runs.
  For example, to create a Gmail label in every new employee's mailbox:
  • Create a rule with the User created trigger and the Create Gmail label action.
  • In the action's Actor field, under Act as another user in your Google Workspace organization, go to Variables and select User created > User primary email.
  • Each time a new user is created in Google Workspace, the rule creates the label in that new user's mailbox.
    
• Does the impersonated user know?
  They are not asked for consent. Changes the rule makes appear in Google Workspace as made by that user.
  
• What happens to my rules if the service account is disabled or deleted?
  If a rule has a trigger or action that acts as another user, the rule is disabled. Otherwise, the rule is not affected. After the service account is ready again, turn the disabled rules back on yourself.
  
• How can I see who a rule acted as?
  Go to the Logs page and find the trigger event or action history. If the trigger event or action history shows a user chip (with user name and email address), it indicates that the trigger was triggered by the user account, or the action ran as another user.
  
• Why does the Actor field ask me to grant permissions again?
  Each Google service related trigger or action requires its own Google permissions. When you add one that needs a new permission, you grant it once, either with Connect with Google (yourself) or through the service account and Domain Wide Delegation (another user).
  
• Why don't I see the Actor field?
  The Actor field is only available after setting up a service account. If the Actor field still does not show, the trigger or action does not support the Actor feature.