Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI agent security depends on four separate controls: the provider authorization and OAuth scopes, the actions the agent or connected app may perform, the data-sharing and retention settings, and the process for revoking access. Grant only the scopes and tools the task requires, keep sensitive or irreversible actions behind confirmation, use a dedicated identity and audit trail for organizational agents, and disconnect or revoke the provider grant when access should end.
An approval prompt is not an authorization boundary. Turning prompts on or off changes when the agent asks before reading or acting; it does not remove an OAuth grant that already lets the connected account or app access data.
What can an AI agent access?
An agent can access whatever the connected identity and granted scopes make available, subject to the tools enabled in the agent. The account you connect, not the agent’s friendly name, is the starting point for the security boundary.
Free tools Windows power users keep installed
One-click scans. No signup required.
Separate the four controls
- Provider authorization: OAuth consent, Microsoft Entra grants, API keys, service accounts and account roles determine which resources are technically available.
- Agent and app actions: Tool settings decide whether the agent may read, create, edit, send, delete or administer resources.
- Data sharing and retention: Conversation context, memory, chat history, uploaded files and provider logs may persist independently of the live connection.
- Revocation: Disconnecting the app, revoking the provider grant, invalidating tokens and removing stale permissions are separate operations.
For example, a connection with read-only mail scope may let an agent search messages but not send one. A broad application permission could allow autonomous access across a tenant even when no human is present. Always evaluate both the scope and the action: “read” can still expose confidential material, while “write” can create irreversible consequences.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What determines the effective boundary?
- The connected user or service identity and its current access to each resource.
- OAuth scopes or Entra permissions, including whether they are delegated to a user or granted to an application.
- Enabled tools, connectors, workflows and event-triggered jobs.
- Agent rules such as confirmation requirements, allowed destinations and blocked operations.
- Provider-side policies, tenant restrictions and resource-level sharing.
The narrowest effective boundary wins only when every layer is narrow. A read-only agent can still disclose a highly sensitive document if the identity can open it; conversely, a powerful identity is dangerous if an app has no tool capable of using that privilege.
What data does an agent share with a connected app?
A connected app may receive relevant parts of the conversation as context for a request. When Memory is enabled, it may also use relevant saved memories. Basic visit information such as IP address, device or browser type, language, region and approximate location can be shared as well. The connected app’s terms and privacy policy govern how it handles that information.
Think in three data categories
| Category | What it means | How to control it |
|---|---|---|
| Data the agent can fetch now | Content available through the connected account and its current scopes. | Narrow scopes, remove unnecessary tools, and reduce the account’s own access. |
| Context sent to an external app | Relevant conversation text, selected files, query terms or memories needed to complete the action. | Review the app’s privacy policy; avoid placing secrets in prompts; disable Memory or model-improvement features where appropriate. |
| Data already retained | Existing chats, saved memories, uploaded files and provider or app logs. | Delete each class separately; disconnecting a connector does not erase it automatically. |
For Google connections, the agent can access only content available to the Google account you connected and authorized. Disconnecting that account stops future access through the connection, does not delete existing conversations or saved memories, and does not alter the original Google files.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Before connecting a sensitive system, identify which of these three categories your policy permits. A connector can be removed while a copied excerpt remains in a chat, memory store or app log, so retention review belongs in the offboarding procedure rather than as an assumption about disconnection.
Do approval prompts revoke access?
No. Approval settings govern when the agent asks before reading information or taking an action. They do not create, narrow or revoke provider authorization.
What the common permission choices mean
| Setting | Operational behavior | Security trade-off |
|---|---|---|
| Always ask | Requests confirmation before each supported read or action. | Best visibility, but users may approve habitually and interrupt automated work. |
| Allow read actions | Permits configured reads without a prompt while write actions remain gated. | Useful for search and summarization; data exposure still follows the granted scopes. |
| Allow low-risk actions | Runs actions classified as low risk automatically and asks for higher-risk work. | Efficient for reversible tasks; classification errors or unexpected targets remain possible. |
| Allow all actions | For eligible connections, permits configured actions without confirmation. | Highest automation and highest blast radius, especially with write or delete tools. |
Changing an app permission does not disconnect the app or revoke access already granted to the provider account. If a connection should no longer exist, use the disconnect or revoke procedure, not only the approval control.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I limit an agent to read-only or low-risk actions?
Apply restrictions at both the provider and agent layers. Provider scopes should prevent writes wherever possible; agent settings should then require confirmation for the remaining operations.
- Choose a dedicated user or service identity whose account access matches the task, rather than using a personal administrator account.
- Request only the read scopes needed for the specific resources. Do not accept broad “all files” or tenant-wide permissions when a folder, mailbox or site will do.
- Disable create, edit, send, delete, sharing and administration tools unless the workflow explicitly requires them.
- Set read-only or low-risk execution as the default, and require a confirmation immediately before an irreversible or externally visible action.
- Constrain destinations and resources with allowlists. A rule that permits “send mail” should identify approved recipients or domains where the platform supports it.
- Log the identity, effective scope, action, resource, correlation ID and the human user on whose behalf the action occurred.
- Test denied actions with a non-production resource, then test the revocation path before deploying scheduled or event-triggered runs.
Re-review access whenever tools, data scope or deployment environment materially changes. A harmless read-only prototype can become privileged when a new connector or write tool is added.
What is the difference between delegated and application permissions?
Delegated permissions let an agent act for a signed-in user and stay within that user’s access after consent. Application permissions give an app its own authority for autonomous service scenarios and therefore need stronger administrative review.
| Question | Delegated permission | Application permission |
|---|---|---|
| Who authorizes? | The user consents, sometimes with administrator approval. | An administrator grants the application access for the tenant or service. |
| Is a human present? | Usually yes; actions are bounded by the user’s effective access. | Not necessarily; the app can run unattended. |
| Scope of authority | User-bounded and commonly resource- or role-limited. | Can be tenant-wide or service-wide, depending on the permission. |
| Typical risk | Compromise of one user’s accessible data and actions. | Broad autonomous access and larger blast radius. |
| Review standard | Check the user’s role, consent screen and requested scopes. | Require explicit administrator consent, named ownership and periodic review. |
Some high-risk Microsoft Graph application permissions are blocked for agents, including Application.ReadWrite.All, RoleManagement.ReadWrite.All, User.ReadWrite.All and Directory.AccessAsUser.All. A blocked permission is not a reason to seek an equivalent broad permission; redesign the workflow around a narrower, reviewable capability.
How should I request OAuth scopes safely?
Use least privilege and make every requested scope understandable to the person approving it. Google recommends requesting only necessary scopes, explaining why each is needed, using incremental authorization and checking which scopes users actually granted.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A practical scope-review checklist
- Map each tool operation to one or more scopes; remove scopes with no corresponding operation.
- Prefer resource-specific access over account-wide access.
- Start with read access and add write access only after the read workflow is proven.
- Use incremental authorization so a later feature requests its own scope instead of front-loading every possible permission.
- Record the consent date, approver, purpose and expiry or review date.
- Compare requested scopes with effective scopes after consent; users may decline some requests.
- Provide a documented way to disconnect and re-authorize with a reduced set.
Scope names can sound similar while carrying very different consequences. Read the provider’s definition, affected resources, whether the scope is sensitive or restricted, and whether an administrator must approve it. Treat a scope that can share, delete, impersonate or change configuration as high risk even if the agent’s current prompt says “low risk.”
Rank #3
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & convenient login: Plug in your YubiKey via USB-A and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most secure passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
How do I revoke ChatGPT, Claude or another agent’s access?
Use a sequence that stops new work, removes the connection, revokes the provider grant and cleans up retained data. Do not rely on one toggle.
- Pause activity. Disable scheduled jobs, webhooks and event-triggered runs so the agent cannot start another operation during offboarding.
- Disconnect in the agent. In the agent or ChatGPT settings, remove the connected account or app.
- Revoke at the provider. Open the provider’s security, consent or connected-app page and revoke the OAuth grant or unlink the app when that option exists.
- Remove enterprise grants. In Microsoft Entra or a Google Workspace administration console, remove or narrow the app grant and disable unwanted actions.
- Invalidate credentials. Rotate exposed client secrets, API keys and service-account credentials; invalidate active tokens where the provider supports it.
- Remove stale permissions. Delete unused roles, group memberships, shared-folder access and old service principals.
- Review retained content. Delete chats, memories, uploaded files and logs according to your retention policy. This is separate from disconnecting the account.
- Verify. Attempt a read and a write with a test resource, confirm the token is rejected, and check audit logs for any activity after the revocation timestamp.
- Reconnect minimally, if needed. Reauthorize only the scopes and action set required for the replacement workflow.
Microsoft recommends testing revocation paths that include disabling the agent, rotating credentials, invalidating tokens and removing stale permissions. A completed disconnect should have an observable result in the provider’s consent record or audit log.
What changes take effect immediately?
Claude’s Microsoft 365 guidance gives concrete examples: revoking Sites.Read.All blocks SharePoint access, Mail.Read blocks Outlook access, Chat.Read blocks Teams chat, and file-read scopes block OneDrive access. Those permission changes take effect immediately for the organization, although already copied content in chats or logs still requires separate deletion.
How should an organization govern an AI agent?
Give each agent a dedicated identity, a named owner and an approved purpose. Microsoft recommends a unique, dedicated agent identity with a named owner or sponsor and approver.
Minimum governance record
- Business purpose, data classification and approved deployment environment.
- Identity owner, technical operator and person authorized to approve changes.
- Connected systems, exact scopes, tools, resource boundaries and expiration or review date.
- Whether each permission is delegated or application-level.
- Log fields for identity, role, effective scope, action, resource, correlation ID and the user on whose behalf the action occurred.
- Test evidence for denied actions, token invalidation and full revocation.
Deny unreviewed tools and cross-tenant paths by default. Reassess the aggregate or effective permissions, not just the list shown on one connector screen. Re-review after a connector update, new data source, role change or move to a different deployment environment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can a security key improve agent-account security?
Yes, a FIDO2 security key can reduce phishing risk for the account that controls agent connections, but it does not narrow OAuth scopes or revoke an existing grant.
Rank #4
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A YubiKey 5 NFC supports USB-A and NFC authentication and FIDO2/WebAuthn, with compatibility across Google, Microsoft and many other services. Use it to protect administrator and owner accounts that approve connections, especially where phishing-resistant sign-in is available. Keep a recovery method under organizational control, test sign-in on the devices your team actually uses, and remember that strong authentication protects the account without changing what an already-authorized app can do.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What should I check when access still appears after revocation?
First determine whether you are seeing live provider access or previously retained content. A cached chat excerpt, memory, uploaded file or log entry can remain visible after a token is invalid, while a fresh API request should fail.
- Check the provider’s consent page for any second grant created by another user, tenant or environment.
- Look for multiple refresh tokens, service principals, API keys or workload identities tied to the same workflow.
- Confirm scheduled jobs and webhooks are disabled; otherwise a replacement credential may keep the workflow running.
- Inspect audit logs for the resource, identity and correlation ID rather than relying on the agent’s status label.
- Delete retained chats, memories, files and app-side records under their respective retention controls.
- If a secret was exposed, rotate it first and investigate activity between exposure and invalidation.
Frequently Asked Questions
How can I tell whether an agent is using a user token or an app-only token?
Inspect the consent record and token claims in the identity provider’s administration tools. A user sign-in and delegated scopes indicate user-bounded access; a client credential, service principal or workload identity indicates app-only authority. If the record is unclear, treat the connection as app-level until its owner documents otherwise.
Do OAuth tokens always stop working as soon as I remove an app?
Not necessarily. Some providers invalidate refresh tokens immediately while short-lived access tokens may remain valid until expiry. Explicitly revoke the grant and invalidate active tokens where supported, then verify with a test request and the audit log.
Should I use a separate account for an agent that handles confidential files?
Yes, a dedicated identity limits the blast radius and makes ownership, review and logging clearer. Give it only the approved folders, sites or mailboxes, avoid personal administrator accounts, and remove the identity when the workflow is retired.
Recommended Free Tools
What is the safest way to test an agent’s permissions?
Create a non-production test resource with representative but non-sensitive content. Test an allowed read, a denied read outside scope, a blocked write and a post-revocation request, then retain the resulting audit events as evidence.
Can deleting a conversation remove data copied into a connected app?
No. Deleting the conversation affects the agent’s retained copy according to its retention controls, but an external app may have stored a request, attachment or result under its own policy. Request deletion from that app separately and verify its retention period.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
