Why does a one-off audit stop working?

Because permissions aren't static. A tool updates, adds a feature, quietly requests a broader scope to support it, and the new grant slots in without a prompt that feels worth reading. This week's audit gives you an accurate picture today. Nothing about today's picture is binding on next April.

The fix isn't more vigilance — vigilance doesn't scale to a habit you'll actually keep. It's a fixed, low-effort repeat: the same five-minute check, four times a year, cheap enough that skipping it would take more willpower than doing it.

What's the actual four-times-a-year version?

Screenshot the three settings pages from Tuesday's audit — Google's connected apps, Microsoft's app access, your AI platform's integrations — and save them with the date in the filename. That's the entire habit. No analysis required in the moment; the value comes from being able to compare one quarter's screenshot to the last.

Put it on the same calendar entry as the 20-minute Saturday reset already recommended here for closing the week like a CFO — quarterly instead of weekly, but the same principle: a fixed slot beats a vague intention to "check on this sometime." Most founders who try to do this "when they think of it" never do it again after the first time.

What am I actually comparing, quarter to quarter?

Three things, and each takes seconds once you have both screenshots open side by side.

New connections. Anything on this quarter's list that wasn't on the last one gets Wednesday's one-sentence test applied immediately — not added to a backlog, done on the spot while the context is fresh.

Changed scopes. The same tool, a bigger grant than last time. This is the update-creep case from above, and it's the one most people miss, because the tool name looks familiar and familiar reads as safe.

Dead weight. Anything that hasn't moved — no scope change, but also no sign you've used it — is a candidate for the two-minute revoke covered tomorrow. A connection earning its place should show some sign of being used; one that doesn't is quietly costing you exposure for nothing.

Isn't quarterly too infrequent for something this important?

It would be, if the goal were catching a problem the moment it appears. That's not what this habit is for — the audit and the one-sentence scope note already do the immediate-catch work, done properly once and updated whenever you add a new connection. The quarterly screenshot is a different kind of check: not "is something wrong right now" but "has the picture drifted since I last looked, in a way I wouldn't otherwise notice." Four times a year is enough to catch drift before it compounds into something that would have needed the immediate-catch process to find instead.

The honest trade-off: a monthly habit would catch drift faster, and a yearly one would catch it slower but cost almost nothing. Quarterly is the version most solo founders will actually keep, and a habit you keep beats a stricter one you abandon after month two.

What do I do with four quarters of screenshots after a year?

Delete the oldest one and keep three. You don't need a permanent archive — you need the ability to answer "did this change recently," which only requires the last comparison, not every comparison you've ever made. If a screenshot ever needs to prove something after the fact — an unexpected charge, an odd automated action — the most recent one is the useful evidence; the rest is just weight.

For the guide that finds every place AI already touches your business — free, 5-min read: The 10-Hour Audit.

Related Decodes

• The Agent You Never Approved — this week's hub.
• Delegate the Task, Keep the Key — yesterday's post: the gap this habit catches before it regrows.
• Close the Week Like a CFO — the same fixed-slot discipline, applied weekly instead of quarterly.
• Revoke First, Ask Questions Later — tomorrow's post: what to do with what this habit finds.

AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.

Not financial or legal advice. Settings page names and locations change without notice; verify against the live account before treating any of this as current.

TL;DR: A one-off permissions audit decays the moment a connected tool updates and quietly requests a broader scope. The fix is a fixed quarterly habit, not more vigilance: screenshot the same three settings pages each quarter, save them with the date, and compare against last quarter's for three things — new connections (apply the one-sentence test immediately), changed scopes on existing tools (the most commonly missed case, because a familiar tool name reads as safe), and dead connections showing no sign of use (candidates for revoking). Quarterly is a deliberate trade-off — more frequent would catch drift faster but rarely gets kept as a habit; this is the cadence most solo founders will actually maintain. Keep only the last three screenshots; you need the ability to spot recent drift, not a permanent archive.