AgentFence Feature
Govern the apps acting on your behalf
AegisAI, OAuth Governance
Example figures- OAUTH APPS
- 73
- connected
- HIGH-SCOPE
- 12
- broad grants
- DORMANT
- 19
- unused grants
- App with read-only calendar scope
- low risk
- App with full mailbox + send
- high risk
- Grant unused for 180 days
- revoke candidate
- App action out of granted scope
- denied
- oauth_governance.py
- deterministic
An OAuth grant is standing access
When a user clicks “allow,” a third-party app gets a token that can act on your behalf, often with broad scopes and no expiry. Those grants pile up, go dormant, and are rarely reviewed. AegisAI (oauth_governance.py) governs them: it surfaces the grants and their scopes, scores the risk of each, and, because an OAuth app is one of the actor types the decision point covers, evaluates what a connected app actually does per action.
What governance surfaces
| Signal | Risk | Response |
|---|---|---|
| Broad scopes (full mailbox, send) | High blast radius | Review / tighten |
| Dormant grant | Unused standing access | Revoke candidate |
| Action outside granted scope | Scope violation | Denied at the PDP |
| Unknown or unverified publisher | Unvetted third party | Flag for review |
Per-action decisions on connected apps
Governance is not only a periodic review: an OAuth app is a first-class actor at the decision point. When a connected app tries to act, scope containment checks that the action is within the granted scope, tenant isolation applies, and the sensitivity ladder gates writes and sensitive reads. An app cannot quietly do more than it was granted.
What OAuth governance gives you
- A live inventory of connected apps and their scopes
- Risk scoring that surfaces broad and dormant grants
- Per-action scope enforcement at the decision point
- Revoke candidates for unused or over-scoped grants
How it connects
- OAuth apps are governed as non-human identities
- SaaS security posture extends this across your SaaS estate
- The decision point enforces grant scope per action
- Risky grants can feed vendor and AI-vendor risk reviews
Questions people ask
What is OAuth app governance?
OAuth app governance manages the third-party apps that hold tokens to act on your behalf. AegisAI surfaces connected apps and their scopes, scores the risk of each grant, and, because an OAuth app is a first-class actor at the decision point, enforces per-action what a connected app may actually do.
Why are OAuth grants a security risk?
A grant gives a third-party app standing access, often with broad scopes and no expiry, and these grants accumulate and go dormant without review. A widely scoped, unused grant is a standing liability, which is why governance flags high-scope and dormant grants for tightening or revocation.
Can it stop an app from exceeding its scope?
Yes. Because an OAuth app is one of the actor types the decision point covers, scope containment checks each action against the granted scope. An action outside that scope is denied, so a connected app cannot quietly do more than it was authorized to do.
How does OAuth governance relate to SaaS security?
OAuth grants are a major part of SaaS risk, so OAuth app governance feeds into SaaS security posture, which looks across your SaaS estate for risky configurations and connections. Governed as non-human identities, OAuth apps are part of the same identity and decision model as agents and service accounts.
Keep reading
Guides
Calculators
One finance briefing a week
New guides, checklists and benchmarks, by email. Unsubscribe from any issue.
Take control of your OAuth grants
Surface scopes, score risk, and enforce grant scope per action.