Solution for Google Suite power management

[JesRes]

There are a number of functions available via the Google Suite API, that are not accessible via the front-end for normal users. My organization is looking for a tool that provides access (preferably through a GUI, but CLI is fine if it fits the bill on all other counts) to these functions. I know of a few tools, but they all have issues or concerns. Firstly, I'll list our needs:
 

• Ability to provide granular access to the different functions to different users/groups. Just because someone can run audits on the users and groups doesn't mean they should be able to modify them, being able to reset a user's password doesn't mean they should be able to delegate inboxes, etc
• Should provide access to "hidden" functions that exist in the API but not the official frontend. For example, via the API an admin can delegate a user's inbox without ever cracking open the account via password reset... with the officially provided frontend functions, this can only be done by logging into the account
• Should be able to easily pass a security review. Because of the nature of our organization, and the fact that we are granting super admin access to whatever product we use, this is extremely important. If a product can not pass a security review, we can not use it. End of story.
  • Bonus points if its an open source and self hosted/contained option, since that's one less thing we have to worry about, security-wise.

 

Products I am aware of and have already looked into, and why I don't think they are a good choice:

• GAM - From what I can tell, this tool is an all-or-nothing deal in terms of permissions and roles. It will not work without being provided a superuser, so it can't just be given out arbitrarily to technicians/users and restrict their abilities in a controlled manner. Perhaps there is some method I am unaware of, in which case please let me know, but I tried googling this and got nothing.
• gPanel - Website was riddled with typos and oddities, insecure connection warnings on some of their pages, and zero info provided on their security, or any sign that they have a visible security team to contact with questions. So will not pass a security review.
• BetterCloud - seems to do what we want, but its a monolithic tool that covers way more than we are asking for, and is super pricey... I would prefer a tool that is specific to this need and consequently better priced due to not paying for a ton of features we don't use.

 

Thanks for any help and suggestions.