Grant Trim
Shows which OAuth scopes each integration, bot and AI agent holds but never uses, and writes the revocation plan.
Grant-Trim
Shows which OAuth scopes each integration, bot and AI agent holds but never uses, and writes the revocation plan.
Date: 2026-11-12 Form factor: web app Status: Prototype
What it is
Grant-Trim takes an export of third-party OAuth grants plus the scopes each one actually called in the last 90 days. It puts the two side by side, scores the unused scopes by risk, and flags grants whose owner has left the company. Applying a trim adds a line to a copy-ready revoke/reduce plan.
Who it serves
IAM and security engineers at small and mid-size companies who inherit a pile of "Sign in with" grants, SaaS connectors and AI notetakers and have no clean way to answer "does this thing still need mail-send?" Admin consoles list grants and scopes. They rarely show usage next to them, and they never write the cleanup ticket.
Why it could be profitable
Plausible, not proven. Several recent breaches started with a third party's OAuth token or integration rather than a user password: Vercel via a compromised Context.ai integration (April 2026) and the Klue integration (June 2026), per the write-ups linked below. Non-human identity governance is now a named OWASP project, with improper offboarding ranked first. The likely model is per-tenant subscription for teams (an open-core CLI that reads the admin APIs, paid hosted reviews and scheduled reports). Thin spots: large NHI vendors already sell this, and the sources I found are mostly vendor blogs, so the market size is unverified. The wedge would be price and a small-team focus.
Form factor & scope
A single-page web tool. The prototype uses a fictional tenant of 12 grants. A real version would pull grants from Entra ID, Okta or Google Workspace admin APIs and usage from sign-in/audit logs.
How to run it
- Open
index.htmlin any modern browser. - The seeded problems show in the red banner on load. Click Trim on a card, or Apply all trims, and watch the plan at the bottom fill in. Data is inlined, so it works from
file://.
What's in this prototype
- 12 sample grants (AI agent, CI token, service account, SaaS integrations) with granted vs used scopes
- Planted findings: an AI notetaker with mail-send and full file write whose owner left in August and only reads calendars; a backup account with unused directory admin and no owner; a 212-day-idle demo app with write access
- Risk-weighted scoring, sort and filter, owner-gone filter
- Revocation plan generator with copy button
Roadmap
- Import real grant exports (Entra ID, Okta, Google Workspace) as CSV/JSON
- Pull usage from audit logs to build the used-scope list
- Per-scope explanations and a "what breaks if I remove this" check
- Scheduled review mode with an owner-attestation step
- Output SCIM/API calls instead of a text plan
Sources
- https://www.akeyless.io/blog/klue-breach-standing-secrets/ — Klue integration breach and standing third-party tokens
- https://specterops.io/blog/2026/04/21/the-vercel-breach-explains-why-identity-attack-path-management-cant-wait/ — Vercel breach via an OAuth integration
- https://nhimg.org/articles/owasp-nhi-top-10-shows-why-nhi-governance-lags-behind-access-risk/ — OWASP NHI Top 10 and offboarding risk (vendor commentary)
Requirements
Grant-Trim — Requirements
Goals
- Show granted vs used scopes for every OAuth grant at a glance.
- Surface the riskiest over-grants without the reader searching.
- Produce a revoke/reduce plan that can be pasted into a ticket.
Primary user
An IAM engineer doing a quarterly access review of third-party integrations, bots and AI agents who needs evidence-backed trim recommendations.
Functional requirements
- FR1: Load grants and scope catalog from
sample-data.json(inline fallback onfile://). - FR2: Show each grant's vendor, kind, owner, owner status, last-used age and consenting users.
- FR3: Mark each scope used or unused over the 90-day window.
- FR4: Weight scopes by risk (1–5) and compute unused risk per grant.
- FR5: Show a banner listing critical grants on first load.
- FR6: Flag grants whose owner left or does not exist as orphaned.
- FR7: Sort by unused risk, days idle, or name.
- FR8: Filter all / needs trim / owner gone.
- FR9: Per-grant Trim button; Apply all; Reset.
- FR10: Generate REVOKE (no scope used) or REDUCE (partial) plan lines.
- FR11: Copy plan to clipboard.
User stories
- As an IAM engineer, I want unused scopes highlighted, so that I can cut privilege without guessing.
- As a security lead, I want orphaned grants called out, so that departed staff don't leave live access behind.
- As an auditor, I want a plan listing each change, so that I have evidence of the review.
- As an admin, I want to sort by risk, so that I fix the worst first.
- As a small-team owner, I want AI agents listed beside normal integrations, so that they get reviewed too.
Non-functional requirements
- Runs offline with no build step; no network calls; no real data.
- Keyboard-usable controls; colour is not the only signal (strike-through for unused).
- All names and domains fictional (
example.com).
Out of scope (for the prototype)
- Real IdP connections or revocation calls
- Usage derivation from raw logs
- Multi-user workflow and persistence
Open questions
- How reliable is per-scope usage data across providers?
- Is a read-only open-core tool enough, or do buyers expect one-click revocation?
