I am currently developing an app that integrates Google OAuth with restricted scopes, such as Gmail Compose. Currently I am handling OAuth process in my app, however I ran into an issue that I am required to undergo security assessment when verifying Google App. I am exploring the option of using Zapier to handle these Google actions on behalf of my users to simplify the OAuth process. 

I imagine that the flow would look something like this:

1. User connects his Google account via Zapier provided Google OAuth screen;
2. User invokes “Create draft” or some other action in my system and calls Zapier webhook with some required data;
3. Zapier creates a Gmail draft for that specific users.

So my question is - is it possible to fully rely on Zapier's native Google integrations to handle OAuth and Google API actions for all my users without requiring my app to undergo Google's OAuth verification and third-party security assessment or would this assessment be required regardless when working with restricted scopes?