Every yes to an AI tool leaves a grant behind
Each “Allow” creates an OAuth grant that outlives the click. nerl0 lists every one of them, shows what it opens and who approved it.
Every grant, in one list
nerl0 reads grants from your identity and productivity platforms and puts the app, the scope and the approver in a single table.
How connectors workOAuth grants
6 apps hold access| App | Connected to | Scope | Approved by | Last used | Status |
|---|---|---|---|---|---|
 OpenAI | Google Drive | Read all files | OHOmar Haddad | Last month | Active |
 Claude | GitHub | Read private repositories | MCMaya Chen | This week | Active |
 Slack AI | Slack | Read channels and history | JSJonas Schmidt | Today | Active |
 Atlassian | Jira | Create and edit issues | LKLena Kraus | Never | Unused |
 Salesforce AI | CRM | Read accounts and contacts | OHOmar Haddad | Over a year ago | Stale |
 Copilot | GitHub | Write to repositories | MCMaya Chen | Today | Active |
See the whole list, not one tenant at a time
Apps, scopes, approvers and last use, across every connected platform. The rows here are demo data.
A grant does not expire when the interest does
The click takes seconds. The access can last for years.
Someone clicks “Allow” to try an AI tool. It takes four seconds.
The tool works. It reads files, mail or code in the user’s name.
The experiment ends, the person changes teams or leaves. Nothing tells the grant.
The token keeps working. Nobody owns it, nobody sees it, it is never reviewed.
The AWS root access key can perform any action on any resource in the account
Recommended action: Delete the root account access key · Remove accessDetected: The AWS account has a root access key. The root user holds an access key; the root user is not bound by IAM policies and holds every action on every resource. Source: scan e07c354c-4aaa-4e30-b18f-8a1468449688 observed 2026-11-09T06:00:00Z, aws coverage complete.
A scope is a promise about reach
The consent screen shows a short phrase. What the grant can really open depends on everything the approving user can reach.
The person left. The grant stayed.
Switching off an account does not revoke what that account approved. The directory says offboarded, the tool still holds a working token.
Grants need an owner of their own, and a review that does not depend on anyone remembering.
AtlassianActiveSlack AIActiveOpenAIActiveFind it. Compare it. Revoke it.
Three steps for every grant on the list.
Questions to ask first
These four are in the Question Library. Activate them and every scan answers again.
Browse all questionsMore solutions
Other ways into the same map of authority.
Browse the Academy