KeySkopeWhat is AI tool access governance?
AI tool access governance is the process of deciding who and what may use an AI service, which resources they can reach, who is accountable, and when that access should end. It covers access to the tool as well as permissions granted to integrations acting on its behalf.
Begin with ordinary account questions before evaluating model behaviour. A former employee’s workspace membership, an unowned integration and an excessive administrator role remain access problems even when the application uses AI.
Separate three access surfaces
Workspace accounts
Identify members, guests and administrators. Confirm the organisation or workspace being reviewed and whether local accounts exist alongside federated sign-in.
Integration credentials
Document who owns API keys, OAuth grants and service accounts, what they can reach, and where their permissions are managed. Do not copy secret values into review evidence.
Connected resources
Ask which repositories, documents or other systems a tool can access. A role in the AI workspace and a permission in a connected source are separate pieces of evidence.
An example review
Consider a team using an AI assistant connected to a code repository. Removing a developer from the assistant’s workspace does not by itself prove that every related integration permission has been revoked. Check the workspace account, the integration’s accountable owner and the authorisation in the repository service separately.
Record which parts you actually checked. If the provider does not expose token usage or delegated permissions through your collection method, record that gap and ask an authorised administrator to verify it in the source.
Questions to take to the application owner
- Which workspace or organisation is approved for this use?
- Who can invite members, change settings or manage integrations?
- Which accounts and credentials belong to shared or automated functions?
- Which source resources can the integration access?
- What happens to membership and credentials when an owner leaves?
- What evidence confirms an approved access change took effect?
What this means for KeySkope
Build your AI access review around clear ownership, appropriate permissions and current evidence. Use KeySkope to investigate accounts across your connected systems, and extend the review through each AI provider’s administration tools. Explore the connector directory to plan your connections.
Account review is one part of broader AI risk management. It does not establish what a model generated, whether sensitive data entered a prompt, or whether every AI service in use has been discovered. The NIST AI Risk Management Framework offers broader voluntary guidance for managing AI risks.
Continue your review
Explore the IGA and AI access governance library, check connector coverage or read the documentation.