One click on “Allow”
One click on “Allow,” and a little AI tool had the keys.
(Illustrative scenario, not a real incident)
“Sign in with your company account,”then a permissions screen pops up,and you click “Allow.”Less than five seconds.
At this twenty-five-person consulting firm,project manager A-Kai did exactly thatand installed an AI meeting assistant.The permissions screen said:“Read your calendar,” “Access your cloud files.”
It worked well, so he recommended it to three colleagues.
Half a year later, preparing for a security certification,the consultant asked one question:“Which third-party appscan access the company's cloud files?”
IT opened the admin consoleand saw this assistant for the first time:four people had authorized it,and one of them had already left.
Where does the vendor store the data?Will it be used to train models?No one had read its terms.
I used to think that as long as I hadn't given away my password,I was safe.Later I learnedthat the moment you click “Allow,”what you hand over is a keythat can act as you and open your files.
For one small feature,you hand over the whole cloud drive.Even when you stop using it, even when you've left,that key may still be there.
- Export the list of third-party authorizations from the admin console.
- Look at the permission scopes, not just the names.
- Revoke anything nobody claims, and anything authorized by people who have left.