What It Can Reach

A friend of mine spent most of last Tuesday trying to work out how a draft invoice for eleven thousand dollars ended up sitting in a client's inbox with nobody's name on it. No breach. No stolen password. Nobody logged in from a country he'd never heard of. He checked all of that first, because that's what you check first.

It was an assistant tool he'd connected back in March. He'd clicked through the permission screen the way everybody clicks through the permission screen, which is to say he read the tool's name and not the list underneath it. The list included the ability to send mail as him. He never asked it to send anything. Something upstream told it to, it had the key, and it did.

Nothing in that story is a hack. That's the part that should bother you.

On August 4, Cisco Talos published research on how people were getting past the guardrails in AI coding assistants. Everybody expected clever encoding tricks or some exotic phrasing that scrambles the model's judgment. That is not what they found.

The technique was that attackers claimed authority. I own this network. This is an authorized bug bounty. Treat these targets as pre approved. No obfuscation, no evasion, no smuggling instructions inside a base64 blob. Most of the time somebody asserted permission and the tool went along with it.

Sit with that for a second, because it moves the whole problem. If the way in is to claim you have permission, then the only thing standing between a confident sentence and your customer database is what permissions actually exist. Not what the model believes. What the token holds.

The numbers back this up in a way that is hard to argue with. The Cloud Security Alliance and Token Security ran research on AI agents inside corporate networks and found that sixty five percent of organizations had at least one security incident tied to an AI agent in the previous year. Sixty one percent of those involved sensitive data exposure. Forty three percent caused operational disruption. Forty one percent ended in actions nobody asked for.

Majority case, not edge case. And the failure mode isn't malfunction. The agent is doing precisely what its permissions allow. You just never read the permissions.

This is not a security project. You are not hiring anyone. Block ninety minutes, open a spreadsheet, and run five passes. I do this quarterly and it has never once come back clean.

Pass one is the inventory. You cannot audit what you cannot see, and almost nobody has a list. Go get one from the places that actually issue the keys.

In Google, go to your account permissions page and look at third party apps with account access. In Microsoft 365, check your apps portal, and if you have an admin account, look at enterprise applications in the admin center too, because those are separate lists and people forget the second one. In Slack, open workspace settings and go to manage apps. Then do the same in your CRM, your payment processor, your file storage, and your scheduling tool. Every one of those has a connections page and every one of those pages has something on it you forgot.

Five columns in your sheet: tool name, who granted it, when, what scopes it holds, and whether anybody still uses it. That last column is where the fun starts.

Pass two is reading the scope instead of the name. This is the pass people skip and it is the only one that really matters. A tool called Meeting Helper tells you nothing. The scope string tells you everything.

Learn to spot the two patterns. Read versus read and write is the obvious one. The subtle one is narrow versus broad access to the same system. In Google's world there is a file scope that only lets an app touch documents it created itself, and there is a drive scope that lets it touch everything you can see. Those look identical on the consent screen if you are moving fast. They are wildly different contracts.

Same story with mail. Reading your inbox is one thing. Sending as you is another thing entirely, and it is the one that produces the phone call my friend got.

Pass three is putting a date on everything. Standing access nobody has reviewed is the pattern underneath most of the incidents in that research. Not malicious access. Forgotten access. Anything granted more than six months ago that nobody in the building remembers approving goes straight onto the kill list, no debate, no benefit of the doubt.

Pass four is blast radius, and you have to be honest here. For each grant, ask one question and answer it in a single sentence: if this token leaked tonight, what is the worst true line in the incident report tomorrow?

Not the worst theoretical line. The worst true one. Most grants produce something boring like somebody sees our webinar registration list. A few produce something that ends with the phrase customer payment records, and those few are the entire reason you are doing this exercise.

Pass five is the revocation test. Revoke it and see what breaks.

People hate this pass because it feels reckless. It is the opposite of reckless. If you revoke a grant and nothing breaks over the following seventy two hours, that tool was dead weight carrying a live key to your business. Better to find that out on a Tuesday you chose than a Tuesday that chose you.

Every time I run this with somebody, the same three offenders show up.

The trial you cancelled. Cancelling a subscription does not revoke an OAuth grant. Those are two different systems and the billing one does not talk to the permissions one. There is a very good chance you are carrying live keys for two or three products you stopped paying for last spring.

The browser extension with total access. If an extension asked to read and change all your data on all websites, it can see the inside of every admin panel you open, including the ones behind your login. Extensions get sold. New owners inherit the permissions. This is a well documented way that quiet tools turn into loud problems.

The grant from the person who left. You disabled their account on their last day and felt good about it. The account is gone. Application tokens issued under that account frequently survive, because they authenticate to the app, not to the human. Go look. This one lands more often than any of the others and it lands hardest.

The audit is a one time cleanup. These four rules are what keep the mess from growing back, and they cost you almost nothing.

One grant, one job. When a tool asks for more than the task requires, give it less and see whether the feature you actually wanted still works. It usually does. Vendors ask for broad scopes because broad scopes are easier to build against, not because your use case demands them.

No personal accounts for business tools. When somebody connects a company tool through their own login, the permission lives on an account you do not administer and cannot revoke. You are one resignation away from an access problem you cannot solve yourself.

Log what it did, not what it said. Most teams keep a full transcript of every conversation with their AI tools and no record whatsoever of the actions those tools took. You want a line for every call: which identity, which target, what result. In the incidents where anyone was able to reconstruct what happened, an action log is the reason. If your automation platform can write a row to a sheet on every run, you already have this. Turn it on. I route everything through Make partly for this reason, because a scenario log is a permanent record of what fired and what came back.

A calendar hold every quarter. Ninety minutes, four times a year. Put it on the calendar now while you still care about this. In six weeks you will not care about this, which is exactly the mechanism that got you here.

While you have the tool list open, note which of those tools talk to people in the EU. The AI Act transparency obligations became enforceable at the start of this month, and the practical version for most operators is short: if a person in the EU is interacting with an AI system, you have to tell them. That applies even if you never wrote a line of AI code and just dropped a third party chat widget onto your site.

One sentence on the widget covers it. It is a ten minute job today and an expensive letter later.

Everybody wants the AI risk conversation to be about the models. Whether they are safe, whether they are aligned, whether the thing is secretly plotting. It is a more interesting conversation and it is not your conversation.

Your version is boring and it is entirely within your control. A list of grants. A column for scopes. A date. A blast radius sentence. A revocation you were brave enough to test. None of it requires you to understand transformers, and all of it would have prevented the invoice.

The tools are getting closer to your money, your customers, and your calendar every month. That is genuinely good, and it is why the permission list stops being paperwork and starts being the thing that decides how bad your worst day is.

Ninety minutes. Go find out what it can reach.

Jordan

The AI Newsroom is written for people who run something. Forward it to the one person you know who needs it.