The 20-Minute AI Hygiene Check
Take twenty minutes to review your AI tools and connections. Identify what they can access, what they can do, and what you want to change.
← Back to AI resources01The idea
Access is authority. The more a system can affect people, data, money, or customers, the more deliberately that authority should be granted. Not every connection deserves the same trust, so it helps to have a scale.
| Level | What it means | Typical example |
|---|---|---|
| 1 · Read | Can view, cannot change. | Summarize documents, search files |
| 2 · Draft | Prepares an action; a person decides. | Draft an email or proposal |
| 3 · Write | Changes internal information. | Update a record, edit a file |
| 4 · Send / Publish | Reaches the outside world. | Email a customer, post publicly |
| 5 · Delete / Spend | Hard to reverse. | Delete records, buy things, run code |
| 6 · Authorize | Grants authority to others. | Create logins, approve payments, start other automations |
Levels 4 through 6 are where a person should usually still be in the loop.
02Four places to look
Don't try to map everything. In twenty minutes, these four cover the most ground. Look for wording like Connected apps, Third-party access, Authorized applications, Integrations, Linked accounts, or App permissions, usually under Security, Privacy, Account, or Admin.
01Your Google or Microsoft account
Many apps connected through "Sign in with Google" or "Sign in with Microsoft" can be reviewed from these account-level lists. One of the fastest places to start.
02Your browser
Extensions can read pages and act inside sessions you're already signed into. Remove what you don't use.
03Your automation platform
Zapier, Make, Power Automate, n8n. Look hardest at anything that sends, publishes, or changes records.
04Your AI tools
Each one keeps its own connector list: email, calendar, files, CRM, code. Check them individually.
What this fast pass won't catch
API keys and service accounts that may be managed elsewhere. Connections made with a username and password may not appear in your Google or Microsoft third-party access list. Tools set up on one person's computer. Integrations enabled inside another vendor's console. Anything an employee connected under a personal account. This is a starting point, not a clean bill of health.
03For each one, ask
- What is it for? If nobody can say why it exists, that's your answer.
- What can it read? One folder, or everything?
- What can it change? Create, edit, move, delete?
- Can it reach the outside world? Email, messages, posting, publishing.
- Can it do something expensive or permanent? Deletion, payments, code, production systems.
- Where does a person approve? Does it recommend, draft, or just go?
- Could you stop it today? Do you know where to click, and where the record of what it did lives?
04Write it down
One row per connection. Keep it general: no passwords, no keys, no customer data. You're recording categories of authority, not secrets.
| Tool or connection | What it's for | Level 1–6 | Person approves? | Keep / Reduce / Remove |
|---|---|---|---|---|
05Red flags
If any of these are true, deal with them before you do anything else.
- Something has administrator access because that was the easy setting.
- A tool can email customers without review, and nobody deliberately approved that workflow.
- Something can delete, publish, buy, or deploy with no approval step.
- Nobody remembers why a connection exists or who set it up.
- An automation uses the owner's full access when narrower permissions would do.
- People are adding tools and extensions with no shared list.
- You can't say how to revoke a tool's access.
- Nothing is logged, or nobody knows where the logs are.
06Then do one thing
A list nobody acts on is just a list. Before you close this page: remove one connection you no longer use, or take one thing down a level, write instead of send, draft instead of publish. Then put a date on the calendar to do this again. Choose a regular review date, and review again when important tools or permissions change.
Kevin Butler · Rabbit River Systems
If you want a second set of eyes on what you found, or you're not sure what a particular connection can actually do, I'm happy to talk it through. Twenty minutes, phone or video.
Access is authority. Don't give AI more authority than the job requires. · This is practical operational guidance, not cybersecurity, legal, or compliance advice. Some situations need a qualified professional. · Menu names were current in September 2026; if one has moved, search that product's help for "connected apps."