Where do I actually go to see this?

Three pages, and all three exist right now on accounts you almost certainly already have.

Google: myaccount.google.com → Security → Third-party apps with account access. Microsoft: account.microsoft.com/privacy → App access. Anthropic / OpenAI / most AI platforms: account settings → Connected apps or Integrations. Each one lists exactly what's connected and, critically, exactly what scope it was granted — read-only calendar, full Drive access, send-email-as-you. That list is the actual inventory. Nothing else you do this week matters until you've opened it.

What am I looking for once I'm there?

Three things, in order, and the exercise is genuinely five minutes if you don't stop to investigate each one — that's tomorrow's job, not today's.

First, count. Most people who run this for the first time find more connections than they expected — old integrations from a trial that never got disconnected, a scheduling tool from a project that ended, a browser extension that asked for "all site data" eighteen months ago and has had it ever since. The count itself is the first useful data point.

Second, scope. Next to each connection is a permission level. "Read your calendar" and "manage your calendar" are not the same grant, and platforms increasingly separate them — check whether the tool actually needs the broader one it was given, or whether it was simply the only option offered at setup.

Third, last used. Some platforms show a last-active date next to each connection. Anything untouched for more than about three months is either forgotten infrastructure or a tool you decided not to use — either way, it's holding access for nothing.

Is a long list automatically a problem?

No — and this is where the exercise stops being alarming and starts being useful.

A long list of connections you use, understand and could each justify in a sentence is a sign of a founder running an efficient one-person operation, not a security risk. Delegating tasks to AI tools is the entire premise of this newsletter — the point was never to have fewer connections. It's to have only the connections you can account for, at the scope the task actually needs.

The same logic that applies to giving every AI tool a spending ceiling applies here: a cap doesn't mean you distrust the tool, it means you've decided in advance what "too much" looks like instead of finding out by surprise. A permissions audit is the same discipline, aimed at access instead of spend.

What do I actually do with what I find?

Nothing drastic today — today is inventory, not triage.

Write the list down somewhere you'll see it again: tool name, what it can access, and a one-word note — keep, check, or cut. Tomorrow's post gives you the exact sentence that turns "check" into a decision, so there's no need to resolve the ambiguous ones today. Anything that's obviously dead — the trial that ended, the tool you stopped using — can be revoked right now; Saturday's post is exactly that two-minute action if you want to do it as you go.

The habit that actually matters is doing this more than once. A one-off audit tells you where you stand today. A quarterly repeat is what stops the list from quietly growing back to where it started, the same way it grew the first time.

For the guide that finds every place AI already touches your business — free, 5-min read: The 10-Hour Audit.

Related Decodes

• The Agent You Never Approved — this week's hub.
• Your Business Already Has an AI Incident Statistic — why this audit is worth five minutes, in numbers.
• Give Every AI Tool a Ceiling — the same discipline, applied to spend instead of access.
• The One Sentence That Belongs in Every AI Tool You Connect — tomorrow's post: what to do with the list.

AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.

Not financial or legal advice. Settings page names and locations change without notice; verify against the live account before treating any of this as current.

TL;DR: Every major platform — Google, Microsoft, most AI tools — has a Security or Privacy settings page listing every third-party app connected to your account and exactly what it can access; almost nobody has opened theirs. The five-minute version: open all three pages, count what's connected, check the scope granted next to each one (read vs. manage access are different grants), and note anything untouched for three months or more. A long list isn't itself a problem — the goal was never fewer connections, it's connections you can each account for in a sentence, at the scope the task actually needs. Write down keep / check / cut next to each one; the rest of this week turns "check" and "cut" into concrete actions.