Everything is 100% (sort of easily) debuggable. If you install data explorer you can see the actual JSON payload we injected in the prompt stream. The table ai_api_audit_logs contains the exact prompt we generated.
My original use case for Google was just to allow it to search everywhere, not restrict it down. That said, I think you can manage to get something working here. We may need though to adjust the prompt a bit to understand that this this google search is restricted. We may need an extra setting for it.