How to audit AI permissions

Why AI permissions need their own audit

Traditional access reviews focus on people. AI systems break that model in three ways. First, they are granted access in ways that bypass normal provisioning: a user clicks "Allow" on an OAuth consent screen, a developer pastes an API key into a configuration file, or a business user connects a drive to a chatbot. Second, they act on behalf of people with those people's permissions, so their effective access equals the broadest access of whoever connected them. Third, AI agents can act — send, delete, deploy, pay — at machine speed, sometimes on instructions they read in untrusted content.

The result is that most organizations cannot currently answer "what can our AI access?" An AI permissions audit fixes that by treating every AI tool, agent, and integration as an identity with entitlements.

Step 1: Build the inventory

You cannot audit what you have not found. Combine several sources, because each one misses something:

For each system, record a name, vendor, owner, business purpose, the departments using it, and the account type (consumer, business/enterprise, API, self-hosted). Our shadow AI discovery guide goes deeper on finding unsanctioned use.

Step 2: Map data access

For each system, identify every category of data it can read — not just what it is intended to read. Use categories your compliance team already recognizes:

• Protected health information (PHI)
• Personal information about customers or employees
• Financial and payment card data
• Privileged or confidential legal material
• Source code
• Credentials and secrets
• Internal documents and email
• Public information only

The key question is effective access. A chatbot connected to a user's Google Drive can read everything that user can read, including files shared organization-wide. A coding assistant can read every file in the repository, including configuration files with secrets. Write down the broadest realistic scope.

Step 3: Map capabilities

Reading data creates confidentiality risk. Capabilities create integrity and availability risk. Record whether each system can:

• Send email or messages, or publish content
• Create, modify, or delete files and records
• Query or write to databases
• Execute code or shell commands
• Push code, open pull requests, or modify CI/CD
• Access production systems or manage cloud infrastructure
• Initiate payments, refunds, or purchases
• Change user permissions
• Browse the web or call arbitrary URLs

Then record the autonomy level: does it only suggest, act after a person approves each action, act on its own within limits, or act without limits? High-impact capabilities combined with unsupervised autonomy are where the most serious findings live.

Step 4: Identify how each system authenticates

Credentials determine both blast radius and your ability to respond. Classify each system's credential:

Step 5: Check oversight and logging

For each system, confirm whether its activity is logged, where logs go, and how long they are kept. For agents, logs should record who initiated each action, which tool was called, the target resource, and the outcome. Without this, you cannot investigate an incident or demonstrate what an AI system did not do.

Step 6: Reduce access

Now apply least privilege. For each system, compare its access and capabilities to its documented purpose and remove the difference:

• Revoke OAuth grants for unapproved AI apps and restrict user consent to third-party apps.
• Narrow OAuth scopes (read-only where possible; specific folders instead of entire drives).
• Replace personal and shared credentials with dedicated, least-privilege service identities.
• Rotate any key found in code and move it to a secrets manager.
• Add human approval to high-impact actions: external sends, deletes, deployments, payments, permission changes.
• Separate agents that read untrusted content (web, inbound email) from agents that hold sensitive data or powerful tools.
• Enable audit logging and forward it centrally.

Step 7: Make it repeatable

Permissions drift. Assign an owner to each AI system, schedule quarterly reviews, and require new AI tools and agents to be registered before they are connected to company systems. Keep evidence of each review — date, reviewer, and changes made — because auditors, insurers, and enterprise customers increasingly ask for it.

The FlashTower Scan structures exactly this process: it collects inventory, data access, capabilities, autonomy, credentials, logging, and vendor terms for each AI system, and applies deterministic rules to prioritize what to fix. See AI Permissions.