Clear Path step · Business · AI used on your terms
Control which apps and AI tools can connect to company data
Why it matters: Apps, AI agents and integrations hold standing access through tokens that skip passwords and MFA. Criminals trick staff into approving malicious apps, and old integrations quietly keep access for years.
Do it
- In Microsoft 365 or Google Workspace, require admin approval for new third-party app access.
- Review the list of apps with access to company data; remove anything unknown or unused.
- Prefer the narrowest permission each app needs, such as read-only.
- Give automations and AI agents their own accounts, not a staff member's, so you can see and revoke them.
- Repeat the review quarterly.
Check it worked: Staff can't approve new third-party apps on their own, you've reviewed every app and AI tool with access to email, files and calendars, and unused connections are revoked.
If an outside IT company handles your IT, send them this:
Hi, could you please set our Microsoft 365 (or Google Workspace) so staff can't approve new third-party apps without admin approval? We'd also like a review of every app and AI tool with access to email, files and calendars, removal of anything unknown or unused, the narrowest permissions for the rest, and separate accounts for automations and AI agents. Please send us the list and confirm when done.
Simply put
Every connected app is like a contractor with a key card who never handed it back. Requiring approval for new ones and reviewing the rest each quarter means only the keys you still need keep working.
In detail
Non-human identities, meaning tokens, service accounts, API keys and agent connections, can outnumber the people in a cloud account and are rarely reviewed. Several large supply-chain breaches have spread through a single integration's stolen tokens rather than any password.
Points toward the Long View: every app and AI agent with its own visible, revocable access.