One Click Gave That AI Agent Standing Access to Your Data. Who Approved It?

When did anyone at your company last approve an AI agent's access to the CRM, the shared drive, or a mailbox? In most of the environments we review, nobody approved it in any formal sense. An employee connected a meeting assistant, a sales-engagement tool, or a chat agent, a consent screen asked for permission to read and write data, and they clicked Allow. That single click is now the most common way AI agents get standing access to business systems, and it is the part of AI agent OAuth consent that almost no one is governing.

Here is the short answer. AI agents usually reach your data through OAuth consent, where a user grants an app delegated permissions and the app receives tokens that keep working long after that moment. Governing that access means deciding who may grant consent, for which permissions, with a named owner and a tested way to revoke it fast.

We have already written about the scale of the problem in how AI agents now outnumber employees and who is managing their access, which covers inventories, ownership, and least privilege for the agents you run. This piece looks at a narrower and more neglected moment: the instant an agent is granted access in the first place, and the token it walks away with.

The Risk Is Not the Agent. It Is the Token It Holds.

Most AI security conversations focus on the model: whether it hallucinates, whether it can be manipulated by a malicious prompt, whether the vendor trains on your data. Those questions matter, but they miss where the durable exposure sits. Once an employee consents, the agent's vendor holds a refresh token that can pull your data without a password and without another multi-factor prompt. Your security now depends on how well a third party protects that token.

That is the belief worth challenging. Many leaders assume that if their employees use strong passwords and MFA, connected AI tools inherit that protection. They do not. MFA protects the sign-in. A delegated token is what the agent uses after the sign-in, and it keeps working whether the employee is at their desk, on vacation, or long gone.

How Do AI Agents Actually Get Access to Your Business Systems?

Most AI agents get access through OAuth delegated permissions granted on a consent screen, not through a new account that IT creates. The user approves scopes such as reading mail, managing files, or accessing CRM records, and the agent's platform stores the resulting tokens so it can act on that user's behalf continuously. No ticket is filed, and no one in IT necessarily sees it happen.

The business consequence is that your real access map no longer matches your org chart. Each of those grants is a business decision about data sharing with a vendor, made in seconds by someone who was never asked to weigh it that way.

What the Salesloft Drift Breach Showed About AI Agent Tokens

The clearest documented example is the 2025 campaign that Google Threat Intelligence Group traced through the Salesloft Drift integration. According to Google's threat intelligence report, from as early as August 8 through at least August 18, 2025, an actor used compromised OAuth tokens associated with the Drift application to systematically export data from Salesforce customer instances, including Cases, Accounts, Users, and Opportunities. The actor then searched that data for secrets such as AWS access keys, passwords, and Snowflake-related tokens. Salesloft and Salesforce revoked the active Drift tokens on August 20, and Google later confirmed the actor had also compromised tokens for the Drift Email integration and used them to reach a small number of Google Workspace accounts configured to integrate with Drift.

The Cloud Security Alliance's analysis of the incident describes Drift as a third-party AI chat agent and notes Google was aware of more than 700 potentially impacted organizations. The lesson for a mid-sized business is uncomfortable: none of those victims needed a phished employee or a broken firewall. The trust had been extended months earlier, through a legitimate integration someone approved to make the sales team more productive. Google's guidance afterward was to treat every token stored in or connected to the Drift platform as potentially compromised, which only works if you know which tokens you granted.

Why Don't MFA and Vendor Reviews Catch This?

They do not catch it because both controls happen at the front door, while token abuse happens after the door is already open. A vendor security questionnaire tells you how a provider says it operates. It does not tell you which of your users granted which scopes, or how long those grants have been live.

Current research shows how common the gap is. Sophos surveyed 5,000 IT and cybersecurity leaders across 17 countries in the first quarter of 2026 for its State of Identity Security report and found that 71 percent suffered at least one identity-related breach in the past year, with weak management of non-human identities cited in 41 percent of incidents. Only one in three organizations regularly rotates or audits service accounts and non-human identities. Sophos also warns that agents can spin up sub-agents, each generating new credentials with broad, persistent access and inconsistent human oversight.

In its 2026 Top 10 for LLM Applications, the OWASP GenAI Security Project ranks Excessive Agency third, calling it the risk where expert judgment and the incident record agree most clearly. Broad OAuth scopes granted on a consent screen are one of the simplest ways an agent ends up with more agency than its job requires.

Who Should Be Allowed to Approve an AI Agent's Access?

Employees should be able to approve only low-impact permissions for apps from verified publishers, and anything that reads or writes sensitive business data should route to a named reviewer. That split keeps everyday productivity tools moving while forcing a real decision on the grants that could expose customer records, financial data, or email.

The controls already exist in the platforms most of our clients run. Microsoft's guidance on configuring user consent in Entra ID lets an administrator disable user consent entirely, allow it for any app, or allow it only for apps from verified publishers and only for permissions the organization has classified as low impact. Microsoft explicitly recommends the verified-publisher option to reduce the risk of malicious apps tricking users into granting access. Paired with the admin consent workflow, a user who hits a blocked permission can send a request to a designated reviewer instead of giving up or finding a workaround.

For agents that run with their own identity rather than borrowing a user's, Microsoft's agent identity governance documentation introduces sponsors: human users accountable for decisions about an agent's lifecycle and access. Sponsors can request access packages on an agent's behalf, which puts a person and an approval path in front of every new permission. The table below shows how we typically tier these decisions.

What Does an AI Agent Consent Policy Look Like in Practice?

A workable policy is short, enforced in the identity platform rather than a document, and built around five moves. In order, this is what we put in place first:

1. Pull a report of every existing app consent and enterprise application in your tenant, and flag anything with mail, file, CRM, or directory scopes that no one can explain.
2. Restrict user consent to verified publishers and permissions you have classified as low impact, so new high-risk grants stop by default.
3. Turn on the admin consent workflow and name real reviewers, with a response target measured in hours, not weeks, so the gate does not push people toward shadow tools.
4. Assign a business sponsor to every approved agent, the person who can say what it is for and whether it is still needed.
5. Write and rehearse a revoke runbook: how to disable an app, revoke its tokens, and check its sign-in and audit history within the same afternoon a vendor discloses an incident.

The last step is the one most teams skip, and it is the one the Drift incident made urgent. When a vendor tells you to treat its tokens as compromised, the clock starts immediately. Our earlier piece on ghost agents and the offboarding gap covers what happens to these grants when the employee who created them leaves, and our guide to AI connector security applies the same thinking to MCP-based connectors.

Where This Fits in Your Broader Access Program

Consent governance is an extension of the identity hygiene that already protects human accounts, and it belongs in the same review cycle. If your organization has not yet cleaned up standing privileges for people, start with our walkthrough on cleaning up IAM, MFA, and privileged access, because the same principles apply to agents with even less forgiveness.

The underlying rule is the one behind least privilege access: every identity gets the minimum it needs, for as long as it needs it, and no longer. Applied to Microsoft 365 specifically, our guide on securing Copilot and AI agents before they become shadow IT shows how consent sprawl and shadow agents tend to grow together.

How Securafy Helps Close the Consent Gap

When we take on this work, we start with the tenant itself, not a questionnaire. We export every enterprise application and delegated grant, map each one to a person and a business purpose, and revoke what no one will claim. Then we configure consent policies and the admin consent workflow so high-impact requests reach a reviewer who understands the data.

Because we also run security monitoring for clients, we watch for the signals that matter after approval: unusual sign-ins from service principals, sudden bulk exports through an integration, or an app requesting new scopes. And we keep a tested revoke runbook on file, so when the next vendor discloses a token compromise, the response is a checklist we execute that day rather than a scramble to find out what was connected.

Where To Go From Here

Every AI agent your team connects is a data-sharing decision, and right now most of those decisions are being made on a consent screen in seconds. Pulling one report of the app grants already live in your tenant is the fastest way to see how much access has been handed out without a review.

If your team is moving faster with AI than your guardrails are, start with structured training rather than another tool. AI University gives your people role-based AI training with security built into the material, not bolted on afterward.

If you would rather talk through your specific environment first, book a strategy call with Securafy and we will walk your current AI usage, exposure, and the fastest path to safe adoption.