x
Because investigating first is the step that never happens. A connection that looks suspicious but isn't actively causing a problem gets a mental note — "I'll look into that" — and the mental note is where these things go to die. Revoking access is reversible in almost every case: reconnect the tool later, in five minutes, if it turns out you needed it. The asymmetry matters. The cost of revoking something you didn't need to is a five-minute reconnection. The cost of not revoking something you should have is the incident statistic from Monday waiting to happen to you specifically.
Same three pages as Tuesday's audit: Google's connected apps, Microsoft's app access, your AI platform's integrations page. Each connection has a Remove or Revoke access button next to it — not buried in a sub-menu, not requiring a support ticket. Click it, and the grant ends immediately. That's the entire mechanism. There's no step two.
The two minutes isn't spent revoking — that part takes seconds per connection. It's spent on the one judgement call worth making first: is this connection something I use, something I might use, or something I forgot existed? Only the third category gets revoked on sight; the other two get Wednesday's one-sentence test before you decide.
It's the risk that stops most people from ever clicking the button, and it's smaller than it feels. Most connections that get forgotten are forgotten because nothing depends on them any more — the workflow that needed them already changed or ended, which is usually why the connection stopped feeling relevant enough to remember. If revoking one does break something, the fix is the same five-minute reconnection mentioned above, now armed with the specific knowledge of what it was actually for — which is more than you had before you revoked it.
This is the same logic applied here to automations that quietly keep running after their original job ended: the thing costing you isn't the automation itself, it's the gap between when it stopped earning its keep and when someone noticed. A permission is the same shape of cost, just paid in exposure instead of pounds.
No — that's the same reflex as "connect nothing" from earlier this week, and it fails for the same reason. A blanket revoke breaks real workflows, teaches you nothing about which connections were actually the problem, and produces exactly the kind of disruption that makes people swear off the whole exercise after one bad afternoon. Target the specific, not the whole list. Yesterday's quarterly screenshot habit exists precisely so you're revoking two or three flagged connections each quarter, not doing a full teardown once a year in a panic.
A business where "I don't know what that's connected to" stops being a sentence you'd ever say. Not because you've memorised every scope permanently, but because revoking has stopped being a big decision — it's a two-minute click you make routinely, the moment something stops earning its access, rather than a threshold you have to work up to. That shift is worth more than any single revoke: a founder who revokes easily also grants more carefully, because the two are the same muscle.
Tomorrow's post closes the week with the argument underneath all five days: none of this is a setting you configure once and forget, including the habit itself.
For the guide that finds every place AI already touches your business — free, 5-min read: The 10-Hour Audit.
Related Decodes
AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.
Not financial or legal advice. Revoking a live integration may pause a workflow immediately; confirm nothing time-sensitive depends on a connection before removing it.
TL;DR: Revoking an AI tool's access takes under two minutes per connection and is almost always reversible — reconnecting later, if it turns out you needed it, takes about five. That asymmetry is the whole argument for revoking first rather than investigating first: a mental note to "look into it later" is where suspicious connections go to be forgotten, permanently, with the access still live. The judgement call worth making is narrow — revoke on sight anything you'd forgotten existed, and apply the one-sentence scope test to anything you might still use — rather than a blanket teardown of every connection, which breaks real workflows and teaches you nothing. The goal isn't memorising every scope forever; it's making revoking routine enough that a founder who revokes easily also learns to grant more carefully in the first place.
