One of the easiest ways to give away access to company data doesn’t involve sharing your password at all.

Modern apps and browser extensions often use OAuth or other delegated permissions. Instead of asking for your credentials directly, they ask you to approve access to parts of your account.

That can include things like

  • Reading your email
  • Accessing files in Google Drive or OneDrive
  • Viewing contacts and calendars
  • Posting or sending messages on your behalf
  • Accessing cloud storage
  • Reading profile or account information
  • Maintaining access even after you close the app

The problem is that people have gotten used to clicking Allow the same way they click through a cookie banner or software license agreement.

From a security perspective, that approval can be just as important as handing over credentials.

A malicious or compromised application may not need your password if you’ve already given it permission to access your data.

Before approving a new app, integration, browser extension, or productivity tool, take a few seconds to look at what it’s asking for.

Ask yourself

Does this permission actually make sense for what the tool is supposed to do?

A calendar scheduling app probably needs calendar access.

A PDF converter probably shouldn’t need access to your email, contacts, and every file in your cloud drive.

Also pay attention to tools you approved months or years ago. Third-party access tends to accumulate over time, especially when people test new SaaS tools, AI assistants, browser extensions, and productivity apps.

If you don’t recognize an application, no longer use it, or see permissions that don’t make sense, remove the access or ask your IT/security team to review it.

This is especially important with the explosion of AI tools. Uploading a document or connecting an AI service to email, cloud storage, Slack, GitHub, or another business platform can give that service access to significantly more information than people realize.

The security lesson is pretty simple.

Don’t just think about who has your password. Think about which applications you’ve already authorized to act as you.