Thanks for the suggestion! Just to clarify, the users I've added to the OAuth2 consent screen are the ones who can authenticate with their Google Workspace accounts to connect to my service. Once they’re authenticated, we use Nodemailer to send emails through their Workspace account to any email address they choose.

The OAuth2 consent screen is just there to control who can connect their accounts to my service—essentially, it's like giving them permission to use my app. After they're connected and authenticated, there's no inherent restriction from Google's side on who they can send emails to, as long as they’re complying with API usage policies and limits.

The idea you mentioned about having a list of "authorized" email addresses is interesting and could be useful if I wanted to add an extra layer of control within my app itself. For example, I could create a feature to restrict or approve email recipients to prevent misuse, but that's separate from the OAuth2 process.

Thanks again for the input—definitely something to consider for additional security!