AI Connector Permission Audit 2026: Secure ChatGPT, Claude, Gemini, Copilot, and MCP Access

AI tools are no longer just chat windows. In 2026, a productivity assistant may read Google Drive, summarize calendar events, browse pages, call a remote MCP server, open GitHub issues, draft email, or inspect files through a desktop agent. That makes connector hygiene a practical security habit, not an enterprise-only concern. The question is not “which assistant is smartest?” The question is “what can this assistant see, do, retain, and hand to a tool?”

This guide gives freelancers and small teams a repeatable audit. It is based on public documentation reviewed on 2026-05-25 from OpenAI, Anthropic, MCP, NIST, OWASP, Google, Microsoft, and browser-platform guidance. Product controls change quickly, so use the official admin and privacy pages for final settings before connecting sensitive accounts.

The four connector types to separate

Do not audit every AI feature as one blob. Sort each connection into a risk zone first.

Connection type	Examples	Main risk	Safer default
File upload	PDF, CSV, meeting notes	Sensitive data copied into a model workflow	Redact, use temporary copies, delete when done
SaaS connector	Drive, Calendar, Slack, GitHub	Broad OAuth scope or cross-client exposure	Read-only, folder-limited, project-specific accounts
Browser context	Edge Copilot, AI sidebars, AI browsers	Current tab, open tabs, history, or memory pulled into answers	Separate browser profile and context controls off by default
MCP or agent tool	Remote MCP, local file tools, database tools	Prompt injection plus tool execution	Allowlist tools and require approval for write actions

A low-risk file summary can become high risk if the same assistant also has permission to email the summary externally. Risk is cumulative: data access plus action permission plus retention equals the real exposure.

Build a connector inventory table

Create a spreadsheet or note with one row per connector. Keep it boring and explicit.

Field	What to record
AI tool	ChatGPT, Claude, Gemini, Copilot, local agent, browser assistant
Connected service	Google Drive, Gmail, Calendar, Slack, GitHub, Notion, MCP server
Account boundary	Personal, business, client A, client B, shared workspace
Permission scope	Read-only, read/write, full account, selected folder, selected repo
Data retention	Product default, enterprise boundary, zero-data-retention eligibility, admin setting
Tool actions	Can it send, delete, post, edit, purchase, merge, or invite?
Revocation path	Where to remove access later
Review date	Next monthly or quarterly audit

If you cannot identify the revocation path, do not connect the service yet. For OAuth apps, also check Google Account third-party access, Microsoft account or Entra admin settings, GitHub authorized OAuth apps, Slack app management, and the AI product’s own connector screen. Some permissions can remain valid until revoked even if you stop using the feature.

Minimum safe defaults for freelancers

Use these defaults unless a client or security policy requires something stronger.

• Use a separate browser profile for AI work that touches client data.
• Keep personal email, banking, health portals, and family accounts out of that profile.
• Prefer read-only connectors and selected folders over whole-drive access.
• Do not connect an assistant to multiple clients’ drives in one AI account.
• Turn off browser page context, open-tab context, history personalization, or memory unless the task needs it.
• Require manual approval before sending email, creating calendar invites, pushing code, updating CRM records, or deleting files.
• Remove project connectors during offboarding, not “sometime later.”

MCP needs a stricter review than “install plugin”

The Model Context Protocol makes it easier for AI applications to discover and call external tools. That is powerful, but it also means the connector can become a bridge from natural-language instructions to real systems. Before approving a remote MCP server, document:

1. Who operates the server?
2. Is the URL official and encrypted?
3. What OAuth scopes or tokens does it request?
4. Which tools can the model call?
5. Can you allowlist or denylist tools?
6. Are destructive actions gated by user confirmation?
7. What logs, prompts, tool calls, and outputs are retained?
8. How do you revoke the token?

Prompt injection is the reason this matters. A document, web page, email, or ticket can contain instructions that attempt to manipulate the model. If the assistant only summarizes text, the blast radius is smaller. If the same assistant can call a tool that emails files or changes a database, you need stricter approval gates.

The 30-minute audit workflow

1. Collect connections

Open every AI tool you use and capture the connector list. Then check account-level third-party app pages for Google, Microsoft, GitHub, Slack, Notion, and any password manager or project-management platform. Add browser extensions and AI sidebars to the same inventory because they can read pages or tabs.

2. Remove dead access

Revoke anything you have not used in 90 days, anything tied to a finished client project, and anything whose owner or purpose you cannot explain. This is the highest-return step because unused connectors create risk without productivity.

3. Downgrade scopes

Look for whole-account access and write permissions. Replace them with folder-specific, repository-specific, read-only, or temporary access when possible. If a tool needs write access for one task, grant it for that task and schedule removal.

4. Add approval checkpoints

High-risk actions should not run automatically. Require a human click for email sends, file deletion, external sharing, purchase actions, calendar invitations, Git pushes, ticket status changes, payroll, finance, health, legal, or client data exports.

5. Record retention and training settings

Product policies differ. Some enterprise controls may keep prompts and responses inside a service boundary or exclude them from training, while other API or connector modes may have standard retention. Record the official setting for each workspace rather than assuming all AI features behave the same.

Risk scoring shortcut

Score	Pattern	Action
Low	Single-file upload, no connected account, no sensitive data	Use temporary copies and delete after use
Medium	Read-only calendar, selected Drive folder, selected repo	Keep, but review quarterly
High	Whole-drive access, email draft/send, repo write, CRM update	Limit scope and require approval
Critical	Payment, contract, production database, payroll, legal or medical data	Avoid unless formally approved and logged

A simple quarterly template

Copy this into your notes:

• Export or screenshot current AI connector lists.
• Revoke unused connectors and finished-client access.
• Confirm each remaining connector has a named owner and purpose.
• Check OAuth scopes for read/write and full-account access.
• Review browser AI context, memory, and personalization settings.
• Confirm MCP servers are official, documented, and still needed.
• Test that high-risk tool actions require confirmation.
• Record retention, training, and admin-policy changes.
• Schedule the next review.

Bottom line

AI connectors are a new permission layer. Treat them like password-manager sharing, browser extensions, and contractor access: useful, but never invisible. The safe default for 2026 is separation, least privilege, read-only access, short-lived project connections, and explicit approval before the assistant can act outside the chat window.