Every time an employee clicks "Allow" on an OAuth consent screen, they create a standing trust relationship between two apps. An AI note-taker gets access to their calendar. A task management tool gets access to Slack. A new developer tool gets access to code repositories.
Each of those decisions takes seconds. Reviewing them properly takes much longer.
For IT and security teams, the question isn't whether employees will connect apps to corporate data. They already have, thousands of times over. The challenge now is keeping up: knowing which grants exist, which ones carry real risk, and which ones should be revoked, without spending your entire week on manual reviews.
That's exactly what Nudge Security does.
Why OAuth grants are so hard to govern
OAuth grants don't behave like the rest of your access. One common misunderstanding is assuming OAuth grants inherit the controls you've built around user identity. They don't. OAuth is a completely separate protocol from authentication. SSO governs how a user proves who they are. MFA adds friction to that proof. An OAuth grant is neither of those things.
They also outlast the credentials of the people who create them. Disabling a user in Google Workspace or Microsoft 365 only suspends grants that originated in that platform, but grants issued from third-party apps keep working uninterrupted.
Many grants sit dormant for months without producing a single log entry, but they stay fully valid and can be exercised at any time.
Attackers know this. In the recent Vercel breach, the root cause was a compromised OAuth token from Context.ai, a third-party AI tool that one employee had connected to their enterprise Google Workspace account months earlier. A single point of consent was enough to get in.
The numbers show why this keeps happening:
- 88 average OAuth grants created per employee, 31 of which carry data-level permissions (Nudge Security)
- 40 average apps per organization with programmatic access to sensitive corporate data (Nudge Security)
- 50% of SaaS breaches will stem from overprivileged OAuth tokens by 2027 (Gartner)
At a 1,000-person company, that's 88,000 access paths, and 31,000 of them have a direct line to sensitive data.