Skip to content
Connector Scout
–saved records

Guide

How to evaluate connector permissions and data access

Evaluate a connection by the account that authorises it, the scopes it requests, whether content is indexed, and how it is revoked — not by the vendor's feature summary.

Written and researched by Christian Stewart, Founder and Editor

A connector review is not a security audit of the AI vendor. It is a much narrower question: given this authorising account and these scopes, what could this connection reach on its worst day? Answer that and most other decisions follow. If you are still working out what an AI connector is, start with the concept guide; if you are reviewing a claim we publish, the process behind it is set out in how Connector Scout verifies permissions and capabilities.

This review covers any connection: the authorising account, the scopes it grants, what gets indexed and how it is revoked. If the thing being connected is a specific Model Context Protocol server rather than a packaged connector, you are also taking on the software and the operator behind it, so add the checks in reviewing a specific MCP server on top of this process.

Start with the authorising account

Almost every connection inherits the permissions of whoever authorised it. A connection authorised by an administrator with broad access is a materially different risk from the same connection authorised by an individual contributor. Where possible, authorise with a least-privileged account.

Who can authorise, and whether an administrator has to agree first, is set by the platform. Review ChatGPT app permissions and admin controls, Claude connector permissions, and Gemini Connected App requirements separately rather than assuming one model applies to all three.

Read the scopes, not the marketing copy

  • Distinguish read scopes from write and send scopes explicitly.
  • Note whether scopes are per-resource (a folder, a repository) or tenant-wide.
  • Record whether metadata alone is enough for the use case.

Fetch on demand or index and store?

An assistant that fetches a document when asked leaves a small footprint. One that indexes a whole drive to make retrieval fast creates a second copy of your content, with its own retention and deletion behavior. These are different decisions and deserve different approvals.

Write down the revocation path

Before enabling anything, note exactly where the connection is disabled and who can do it. If nobody can answer that in under a minute, the review is not finished.

Permission examples

Four verified records, chosen because each one fails a different assumption a reviewer is likely to bring to the table. Read the permission section on each record rather than generalising from one of them.

Document what you verified and when

Connector behavior changes. Keep a dated note of the scopes you approved and re-check on a cadence — this directory uses 30, 90, and over-90-day freshness bands for exactly the same reason.

Questions

Sources