# AI connection permissions audit

Original worksheet from AIPulseGuard / APG Tech LLP. Version 1, October 9, 2026.
Source and instructions: https://aipulseguard.com/tools/ai-permissions-audit/

Create one record per connection. Complete it locally. The website does not collect completed worksheets. Use a non-sensitive account alias; do not record passwords, access tokens, customer data or private document contents here.

## Identify the connection

- App / agent / connector name:
- Product version or plan, if known:
- Account alias and type (personal / work / school):
- Connection type (sign-in / account-data access / agent interaction):
- Owner responsible for this connection:
- Review date and reviewer:
- Purpose: the single task this connection should support:
- Administrator involvement or approval required:

## Record permission scope

- Source account / permitted data location:
- Read permissions observed:
- Write / delete permissions observed:
- Sharing / recipient / destination permissions observed:
- Other permissions and limits:
- Evidence reference and date (use an internal reference, not secret content):
- Permissions unnecessary for the task:
- Proposed scope reduction and responsible owner:

## Define action boundaries

- Actions permitted without another review:
- Actions that require human approval:
- Who approves those actions:
- Stop conditions (wrong account, unexpected recipient, missing source, unexpected cost or other):
- Spending / tool-call limit and which charges it covers:
- Logs available and who can inspect them:

## Record revocation and verification

- Provider's current official revocation instructions URL:
- Control used and connection type it affects:
- Changed by whom and at what time:
- Other app / account / agent links still present:
- Harmless read-only check attempted (no private production data):
- Expected result:
- Observed result and time:
- Did the app request fresh authorization? Do not approve it during the check:
- Could the displayed answer be cached or already in conversation history?:
- What this check does NOT establish:

## Track previously shared data separately

- Current provider retention / deletion documentation URL:
- Deletion request needed? Why?:
- Request reference / owner / date:
- Provider confirmation received? What did it actually confirm?:
- Unresolved data-handling questions:

## Decision and next review

- Decision (retain / reduce scope / remove / escalate / unknown):
- Evidence supporting the decision:
- Outstanding uncertainties:
- Responsible person and next action:
- Next review date or event (new permissions, new connector, changed ownership or policy):

Do not turn blank fields into a pass. Use Unknown where evidence is missing. This record supports a decision; it does not certify that an agent is safe or that every data copy has been deleted.

## Useful references

- Permission checklist: https://aipulseguard.com/articles/ai-agent-permissions-checklist/
- Google and Microsoft revocation guide: https://aipulseguard.com/articles/revoke-ai-app-access/
- Cost comparison: https://aipulseguard.com/tools/ai-tool-cost-calculator/