Wsrtjtyk

I am trying to do the following:
I have a number of users in the domain partitioned into organisational units by function. One group I would like to drive their day based on their calendar. Using the GO Language Calendar Library I add events to their individual calendars as required. These event usually require a video conference to be initiated, a phone call to be made, or the invocation of an asynchronous messaging application. Upon completion of these events the user MUST create and store notes about the event and signal completion of the event so appropriate charges can invoiced.
I have been able to achieve this by placing appropriate links in the calendar event; for video conference enable Hangouts Meet, for phone calls again just use meet and provide the client phone number in the event description, for async messaging provide a link to the application in the event description. For creating the event notes place another link in the event description. The custom links all carry query parameters that I use in the applications to attribute info to the right place.
Now my PROBLEM.
This method is not secure even though the user must be logged into their account and access the application from the link; there is an opportunity (albeit small) for someone to get a hold of the link and use it from outside of the gsuite scope.
I can see if the user is logged into gsuite but I can not determine if they are currently active or have been logged in for a long time and just have not logged out.
As far as I can see building a calendar add-on would be the best way to handle this but that capability is currently not revealed for public consumption.

Discussion, ideas, hints are all welcome

Thanks