Start With One Connection
Pick one AI workflow you actually use. Identify the account owner, the app’s publisher and the reason it needs access. Use the provider’s own account settings, not an access-management link from an unsolicited message.
For a team account, ask the responsible owner before changing permissions. This checklist is a review aid, not a security assessment or permission to access another person’s data. It does not inspect or change your accounts.
Separate Login From Data Access
An app can use an account for sign-in and also have a separate data connection. Check each connection type rather than treating the app’s name as one switch.
Google distinguishes sign-in links, linked accounts and access to Google Account data. Its guidance notes that removing a sign-in link does not delete data already on the other app; removing data access can make connected features unavailable. Follow the controls for the connection you intend to change. Google Account connection guidance.
Record What The Workflow Needs
| Question | Record before changing access |
|---|---|
| Which identity? | Personal account, team account or organization, plus the responsible owner |
| Which resources? | The files, calendars or repositories involved, without copying their private contents |
| Which actions? | Whether the connection can read, create, edit or perform another action shown in settings |
| Why is it needed? | The specific workflow that depends on that access |
| What would break? | Expected effects of removing or narrowing the connection |
Compare the granted access with the task you intended. If the scope is unclear, stop the review and ask the owner or provider. Do not approve broader access just to get a test working.
For Repository Work, Check The App Type
GitHub Apps and OAuth apps have different review screens. For an installed GitHub App, GitHub documents reviewing permissions and changing repository access. Suspension or removal affects the installation; authorization to act on a user’s behalf is a separate consideration. Check the account and installation before making a change. GitHub App installation guidance.
GitHub also provides a separate Authorized OAuth Apps view for inspecting and revoking OAuth app access. Do not assume that changing one app type removes every other authorization associated with a workflow. GitHub OAuth app guidance.
Try A Harmless Sample, Then Record The Outcome
For an approved permission change, test the intended workflow using a non-sensitive sample. Confirm both that the required task still works and that the settings now show the intended scope. A successful output alone does not establish that access is appropriately restricted.
Fictional example: a team wants an assistant to work only with a demo repository. The owner discovers a broader installation scope. Before narrowing it, they check whether another project depends on the installation. After an approved change, they inspect the configured repository list and test a small demo task. If another workflow fails, they record the dependency and seek an approved resolution instead of silently restoring broad access.
Leave A Useful Review Note
App and account owner:
Workflow that needs the connection:
Current scope / intended scope:
Official settings or documentation checked:
Owner approval and change made, or "no change":
Sample task result / checks not run:
Remaining dependency or question:
Next review trigger:
Keep only non-sensitive reminders in your shortlist. Never record passwords, tokens, private file contents or customer data there. Browser storage is not a secure account inventory or a synced team record.
Revisit the review when a tool requests new permissions, a team member leaves, an integration changes or a workflow is retired. In Change Watch, leave an announcement unread when you still need to review it. A read check means the notice was read, not that the tool or its permissions are approved.
If the service is ending, use the work-preservation checklist before removing a connection that your handoff depends on. Account controls and available options can change; follow the provider’s current instructions.