← BlogAugust 26, 20267 min read

Somebody at your company already gave an AI tool a login

Ask which AI tools currently have access to your company's systems, who connected them, and under whose login. In most companies between 25 and 150 people, nobody can answer. In the last three weeks Okta, Cloudflare and the maintainers of the standard that wires these tools together all shipped work aimed at exactly that gap, which is the clearest evidence yet that it is normal rather than a failure unique to you.

The list nobody can produce

Try this at your next Monday meeting. Ask which AI tools currently have access to company systems, who connected them, and under whose login. In most companies between 25 and 150 people, the room goes quiet, and then somebody says they think the bookkeeper set something up with QuickBooks a few months ago.

That is not a failure of discipline. It is what happens when connecting a tool takes ninety seconds and requires no budget. Somebody in accounting links an assistant to the books so it can pull invoice history. Somebody in sales points a scheduling tool at their calendar and inbox. Somebody in the field connects a note-taker to the shared drive. Each one is a reasonable decision made by a person trying to work faster, and none of them generated a purchase order, a ticket, or an entry on any list.

The result is that a company with no dedicated ops person now has an unknown number of standing connections into its email, its files, its calendar and its books. Not one of them was approved, because nobody was asked.

Two weeks of releases that all say the same thing

If you want evidence that this is normal rather than a problem unique to you, look at what the infrastructure vendors shipped this month. They are all building the same missing layer at the same time.

On August 24, Okta made Agent SSO generally available. It lets a company register an AI agent in its identity directory the way it registers an employee, apply access policies to it, and hand it short-lived tokens instead of a permanent API key. Okta included it in its core single sign-on plans at no additional cost, which is a decision companies make when they think something has become table stakes rather than a premium feature. In the same announcement, Okta cited its own survey finding that only 34 percent of organizations apply the same security controls to AI agents that they apply to human workers.

Two days earlier, on August 22, the maintainers of the Model Context Protocol updated their public roadmap. MCP is the standard that lets AI assistants connect to outside tools, and the roadmap now carries a priority area called Agent Identity and Enterprise-Ready Security. The plain-language admission in it is worth reading twice: MCP authorization assumes a person with a browser at consent time, and existing MCP servers lean on pasted API keys and long-lived refresh tokens. That is the protocol's own maintainers describing the current state of the thing your staff have been clicking Allow on.

Cloudflare had gone earlier in the month. On August 14 it shipped detection for what it calls shadow MCP, meaning connections an employee sets up on their own, plus a dashboard showing which tools are serving that traffic and which users are generating it. Their description of how it happens is the Monday meeting above. An employee finds the server in a repository, a product guide, or a message from a colleague, and adds it directly. Nobody else knows what it exposes.

The honest read for an owner is not that you should go buy any of this. Okta, Cloudflare Zero Trust and the rest are aimed at companies with a security team, and at forty or eighty people you do not have one. The read is that the gap is real enough that two of the largest infrastructure vendors and the standards body in the middle all moved on it within three weeks, and that you are on the wrong side of it with none of the tooling.

The only distinction that actually matters

There is one useful idea buried in all of this, and it costs nothing to adopt. On August 5, Cloudflare put a feature called WriteGuard into private beta, and to build it they had to sort every action an AI tool can take into four tiers: read only, minimal impact, contained write, and critical. Reading a record is one thing. Posting a comment is another. Merging code, or triggering something that goes out to customers, is a different category entirely.

You do not need their product to use their framework. You need a page in a notebook. For every tool connected to your business, write down whether it can only look at things, or whether it can change them, and if it can change them, whether anyone outside the company would see the result.

Their own example of what goes wrong is useful because it is boring rather than dramatic. An agent was given cleanup instructions that were slightly too broad and closed thousands of tickets in a matter of hours. There was no attacker and nobody's credentials were stolen. Someone wrote an instruction that was fine on Tuesday and wrong on Wednesday, the tool did exactly what it was told at machine speed, and afterwards there was no clean way to tell which closures a person had made.

What actually bites a company your size

The breach headline is not your likely failure mode. Four quieter ones are.

The first is the departure. Someone leaves, you disable their email, and the connection they made between an AI tool and your accounting system keeps running on a token that has nothing to do with their mailbox. You will not find it, because you never knew it existed.

The second is the audit trail. When an agent acts through a person's personal login, every record says that person did it. If a customer asks why a quote changed or why an invoice was voided, your own system will tell you a confident and incorrect answer.

The third is the write you cannot walk back. An email that went out. A record set that got updated. A file that got overwritten in the shared drive. Reading is recoverable. Writing frequently is not.

The fourth is the standing instruction nobody remembers writing. Scheduled and always-on tools keep doing the thing they were set up to do long after the person who set them up moved on to something else. That is a feature, right up until the conditions change.

There is a real cost on the other side of this too, and it is worth naming. If you respond by banning everything, people will go around you, which is precisely how these connections got made without you in the first place. The point is not to stop the tools. It is to know what is connected and where the line is.

What to do next

None of these take a vendor, a project, or a budget line. Most of them take an afternoon.

Make the list. Ask every department what AI tools they use and what those tools can see. Nobody gets in trouble for what they say in this conversation, and you should say that out loud before you ask, or you will get a short and useless list.
Open the admin console you already pay for. Google Workspace and Microsoft 365 both keep a record of which third-party applications have been granted access to your data and by whom. Whoever administers your email can pull that in a few minutes, and it will be longer than you expect.
Require company accounts. If a tool is doing work for the business, it should be connected under an account the business controls, not under someone's personal login. This one change fixes the departure problem and the audit trail problem at once.
Write the read and write line down. Draft, gather, summarize, watch and route are safe to automate. Anything that sends to a customer, moves money, or changes a system of record gets a person's approval before it goes. One sentence in a policy is enough.
Add revocation to your offboarding checklist. Alongside the laptop and the building key, the line item is: check connected apps and revoke.
Pick one tool and turn its write permissions off for a month. If the work still gets done with the tool drafting and a person sending, you have learned what you actually needed it for.

The companies that will handle the next two years of this well are not the ones with the best tools. They are the ones that can answer the question at the top of this post in under a minute.

Sources

Want this looked at for your company?

An AI Blueprint is a short scoping session and a written plan: which of your processes are worth automating, in what order, and what each one would take. Quoted in full before anything starts.

Get your AI Blueprint