2 variants
B1.1
In your AI tenant
Agent mode, browser control and connectors inside your enterprise AI tenant. The vendor runs the agent; you decide what it can reach.Data flow
- 1An employee hands the agent a task: triage the inbox, book a meeting, research a vendor and fill in a form. The agent runs in the vendor's cloud or in the browser, as that employee.
- 2SSO groups decide who gets agent features. ChatGPT Enterprise assigns agent mode by role, and Claude Enterprise and Microsoft 365 by group. On Claude Team, Cowork is one switch for the whole org.
- 3Tenant settings decide what the agent may do: agent mode and browser use, site allow and block lists, memory, and scheduled or event-triggered tasks. Defaults differ. Agent mode is off in ChatGPT Enterprise, Claude in Chrome and Cowork are on for Team and Enterprise, and Copilot Cowork's browser use is off.
- 4The agent acts through connectors with the user's own access. Admins enable each connector, start read-only, and turn on write actions such as send, share and delete per app.
- 5Sensitivity labels and DLP keep labeled files and email out of what the agent reads, where the vendor supports it. Microsoft Purview does this for Copilot; most other vendors have no equivalent.
- 6Anything the agent reads is untrusted. An email, a calendar invite, a shared doc or a web page can carry instructions. EchoLeak in Microsoft 365 Copilot and Zenity's Claude in Chrome account takeover both started with an email.
- 7The agent asks the user before high-impact actions such as sending, sharing, buying or deleting. That prompt is the vendor's control, not yours: users can switch to automatic approval, and few admin consoles can force it back on.
- 8Logs record the session and, on some products, each action. Purview logs every item Copilot reads or changes and flags suspected injection. ChatGPT's Compliance API keeps agent conversations but not the agent's individual actions.
In your AI tenant: build or buy
Mostly buyWhat you can buy for each box in the diagram, the open source option, and the part you still build yourself.
| Component | Buy | Open source | You build | Maturity |
|---|---|---|---|---|
| Vendor agent (ChatGPT, Claude, Copilot, Gemini) | ChatGPT Enterprise (agent mode), Claude Team or Enterprise (Claude in Chrome, Cowork), Microsoft 365 Copilot (Copilot Cowork, Researcher with computer use), Gemini in Chrome auto browse on Workspace Business Standard and up. | · | A written list of the tasks the pilot group may delegate, and the ones it may not. | GA |
| Tenant agent settings | Included in the enterprise tiers: ChatGPT agent mode toggle, role assignment and blocked sites; Claude in Chrome on or off with site allow and block lists; Copilot Cowork browser use by group; Chrome policies for Gemini auto browse. | · | A settings baseline per vendor, rechecked each quarter because defaults change. | GA |
| SSO and agent access by group | Okta, Entra ID or Google groups mapped to ChatGPT Enterprise roles, Claude Enterprise custom roles and Microsoft 365 group targeting. | · | A pilot group and a request path for joining it. | GA |
| Connector settings | Per-app connector controls: ChatGPT read and write action toggles per app (Enterprise), Claude owner-enabled connectors with an org-wide read-only option, owner-only custom connectors on Claude Team and Enterprise. | · | A connector register: which apps, read or write, and who approved it. | GA |
| Labels and DLP | Microsoft Purview DLP for Copilot keeps labeled files and email out of Copilot and Cowork. Google Workspace DLP and Drive labels for Gemini. | · | Labels on the sensitive sites and mailboxes first. Labeling everything comes later. | GA |
| User approval | Built into each agent: confirmations before high-impact actions in ChatGPT agent, Manual or Auto modes in Claude in Chrome, risk-rated approvals in Copilot Cowork. | · | Training on what the prompt means and when to say no. Admins mostly can't enforce it. | GA |
| Agent audit log | Purview Audit (Standard) for Copilot and Cowork, the Claude Compliance API (Enterprise) for Cowork and Claude in Chrome sessions, the ChatGPT Compliance API (Enterprise), the Workspace Gemini audit log. | · | Weekly export to a bucket, and an alert on agent sessions that touch external recipients or sharing. | GA |
Rollout steps
| # | Step | Who | Effort |
|---|---|---|---|
| 1 | List which assistants and agent features are on today in each AI tenant, with their defaults | IT admin | 2-3 days |
| 2 | Turn agent mode, browser control and Cowork off for everyone except a named pilot group | IT admin | 1 day |
| 3 | Set connectors to read-only, then enable write actions per app for named use cases | IT admin + security | 1 week |
| 4 | Add site block lists for banking, payroll, admin consoles and your identity provider | Security engineer | 1-2 days |
| 5 | Turn on audit export for agent sessions and connector actions, to a bucket first | Security engineer | 1 week |
| 6 | Brief the pilot group on approval prompts and hidden instructions in email, then widen access | Security lead | 2-4 weeks |
What you still build
- A settings baseline per vendor, checked quarterly, since agent features ship on by default on some tiers
- A connector register with the read or write decision and owner for each app
- An export job for each vendor's audit or compliance API into one bucket
- A short guide for users on approval prompts and when to stop the agent
Gotchas
- Claude in Chrome and Cowork are on by default for Team and Enterprise. Claude Team can only turn Cowork on or off for the whole org.
- No admin setting forces manual approval in Claude in Chrome, and Cowork's automatic approve mode is allowed by default.
- ChatGPT agent mode controls (on or off, role assignment, blocked sites) are documented for Enterprise. Business workspaces have no documented equivalent.
- ChatGPT's Compliance API keeps agent conversations but not the individual actions the agent takes on its virtual computer.
- Claude in Chrome doesn't support zero data retention, and Cowork's local history can't be centrally managed or deleted.
- Purview DLP for Copilot doesn't cover calendar invites, and policy changes take up to four hours.
- Zenity showed a Claude in Chrome account takeover from one malicious email, even in ask-before-acting mode. Treat approval prompts as a speed bump, not a control.
- Claude Cowork runs local code in a VM that EDR can't see into. Its MDM keys control extensions and local MCP servers, not the agent's actions.
B1.2
Outside your tenant
Third-party AI apps granted the mailbox, open-source agents such as OpenClaw, and coding agents on laptops you don't manage. They get in through grants and tokens, so the controls sit at those doors.Data flow
- 1AI email apps and agent platforms ask for OAuth access to the mailbox, calendar and files, often read, compose and send, and keep the refresh token on their servers.
- 2Local agents such as OpenClaw or Claude Code on a laptop you don't manage try the employee's SSO session. Device checks refuse a new session from an unmanaged device, but they don't stop tokens issued earlier.
- 3So those agents run on OAuth app tokens, personal access tokens and API keys stored on the laptop.
- 4Consent and token policy decide what any of these can reach. Google Workspace limits Gmail and Drive's high-risk scopes to trusted apps, Entra's managed consent stops users granting mail and file scopes, and GitHub can block classic PATs and set a maximum lifetime for fine-grained tokens, such as 90 days.
- 5On managed laptops, MDM and EDR find and remove unapproved local agents: CrowdStrike's OpenClaw removal pack, Jamf detection scripts, Intune. Local agents load community skills, and Koi Security found 341 malicious skills on ClawHub. On unmanaged laptops, the approved place to run agents is a cloud dev environment such as Codespaces or Coder.
- 6Google's OAuth token audit log, Entra consent records and SaaS security tools show which app holds which scopes and flag token use from unknown places. Review new grants weekly and revoke per app per user, including at offboarding.
Outside your tenant: build or buy
Buy + glueWhat you can buy for each box in the diagram, the open source option, and the part you still build yourself.
| Component | Buy | Open source | You build | Maturity |
|---|---|---|---|---|
| AI email and agent apps | Fyxer, Superhuman, Lindy and similar. Check what each one sends: Fyxer says it never sends email on your behalf. | · | A vendor review checklist: scopes requested, send rights, SOC 2, where tokens and mail are stored. | GA |
| Local agents (OpenClaw, Claude Code) | Nothing makes them safe on an unmanaged or standard laptop. If someone needs OpenClaw, run it on a dedicated VM with its own non-privileged accounts. Push Security's browser extension can be self-installed on personal devices for visibility. | OpenClaw | A policy that local agents need approval, plus the VM build for exceptions. | No product |
| Personal tokens (OAuth, PATs, API keys) | GitGuardian for leaked-secret detection in code and repos. | TruffleHog, gitleaks | Per-SaaS token inventory scripts. OAuth app tokens matter more than PATs here. | GA |
| Consent and token policy | Google Workspace API controls (high-risk Gmail and Drive scopes for trusted apps only, block unconfigured apps); Entra user consent settings, Microsoft-managed consent and the admin consent workflow; GitHub Enterprise Cloud token policies (classic PAT restriction, OAuth app restrictions); Slack app approval. | · | An approved-apps list with an approval path that answers within a day, and an AWS service control policy blocking IAM user access keys. | GA |
| Device-aware SSO | Okta with Adaptive MFA (needed for device assurance), Entra ID P1 with Intune, or Google Workspace Enterprise or Cloud Identity Premium for context-aware access. | · | Policy design, report-only rollout, break-glass accounts. | GA |
| MDM and EDR | CrowdStrike Falcon for IT OpenClaw search and removal pack, Jamf detection scripts, Intune and Defender inventory of local agents, SentinelOne hunting queries. | Santa | Block rules by bundle ID or process, and a weekly report of local agents found. | GA |
| Cloud dev environment | GitHub Codespaces, or Coder Premium. Coder AI Premium adds unlimited agents and network-isolated agent workspaces. | Coder Community, DevPod | Devcontainer image with the agent preinstalled, egress allowlist, gateway-issued model keys. | GA |
| Grant and token audit | Push Security, Valence, Obsidian, AppOmni, Reco, Astrix. | GAM, Steampipe, Maester, CISA ScubaGear | Weekly grant diff across Google, Entra, GitHub and Slack, with revoke per app per user. | GA |
| Agent identity | Okta Agent SSO (Cross App Access, GA August 2026, in core Okta SSO plans) and Okta for AI Agents. Microsoft Entra Agent ID with Agent 365 is still partly in preview. | · | Nothing yet. Value depends on your SaaS apps supporting it. | GA |
Rollout steps
| # | Step | Who | Effort |
|---|---|---|---|
| 1 | Inventory OAuth grants, PATs and installed apps with mail, calendar, file or repo access in Google, Entra, GitHub and Slack | Security engineer | 1 week |
| 2 | Restrict high-risk Gmail and Drive scopes to trusted apps, or turn on Microsoft-managed consent and the admin consent workflow | IT admin | 1 week plus 2 weeks of requests |
| 3 | Turn on token policy: restrict classic PATs, require approval for fine-grained PATs, cap lifetime at 90 days, restrict OAuth apps, require admin consent | Platform engineer | 1-2 weeks plus 2 weeks of exceptions |
| 4 | Review each existing assistant app, keep the approved ones, revoke the rest per user | Security engineer | 1-2 weeks |
| 5 | Require a compliant or posture-checked device for source code and sensitive SaaS, starting in report-only mode | Identity engineer | 1-3 weeks |
| 6 | Detect and remove OpenClaw and other local agents with MDM and EDR, and block their domains | Endpoint engineer | 1 week |
| 7 | Stand up a cloud dev environment as the approved place to run agents | Platform engineer | 2-4 weeks |
| 8 | Write and test an offboarding runbook that revokes tokens and sessions in every SaaS | Security engineer | 3 days |
| 9 | Schedule a weekly grant diff, or roll out a SaaS security tool such as Push Security | Security engineer | 1-2 weeks |
What you still build
- Grant inventory and diff scripts over GAM, Microsoft Graph OAuth grants, the GitHub credential-authorization and PAT APIs, and Slack admin APIs
- An approved-assistants list with the scopes each one may hold
- MDM detection and block rules for local agents, plus a VM build for approved exceptions
- Offboarding script that revokes Google tokens, Entra sessions, GitHub SAML authorizations and Slack sessions per user
- Devcontainer baseline with the agent, gateway credentials and an egress allowlist
- AWS guardrails: service control policy plus Identity Center permission sets
Gotchas
- Device checks only gate new interactive SSO sign-ins. A PAT, OAuth refresh token or API key issued earlier keeps working from any device.
- Most coding agents sign in with OAuth app tokens (gh CLI, GitHub Apps, MCP OAuth), not PATs. Restrict OAuth apps, not just PATs.
- Fine-grained PATs default to a 366-day max lifetime. A lifetime policy blocks noncompliant tokens but doesn't revoke them.
- Changing consent settings in Entra doesn't revoke grants users already made. Review and remove them separately.
- Microsoft's default consent exception still lets users grant mail scopes to Apple Mail, Spark, eM Client, Thunderbird and Android mail apps.
- Exchange RBAC for Applications limits app-only mailbox access, not delegated access. It does nothing for an assistant acting as a signed-in user.
- OpenClaw keeps state, memory and credentials on the host and runs tools there unless sandboxing is configured. Microsoft's guidance is a dedicated VM, not a workstation.
- Google context-aware access isn't in any Business edition. Okta device assurance needs Adaptive MFA. Entra compliant device needs Intune enrollment.
- Claude Code stores an OAuth refresh token in a file on Linux and Windows. Any process running as that user can read it, and you can't wipe it.
Common use cases
- Inbox triage and drafted replies
- Scheduling, research and form filling in the browser
- Recurring tasks that run while the user is away
- Coding agents on personal and contractor laptops
Key risks
- Instructions hidden in email, invites or web pages steer the agent
- The agent sends, shares or deletes as the user
- Broad OAuth scopes granted to third-party apps
- Long-lived tokens on devices you can't see
- Malicious skills and plugins on local agents
- Agent memory and history outside your retention rules
Fast path
- KEEPAgent mode and browser control for a pilot group first
- KEEPRead-only connectors first. Write actions per app and use case
- KEEPAdmin approval for apps asking for mail, calendar or file scopes
- KEEPCompliant device required for source code and sensitive SaaS
- KEEPMDM blocks unapproved local agents such as OpenClaw
- KEEPOffboarding runbook that revokes tokens and sessions
- SIMPLIFYWeekly OAuth grant review before a SaaS security tool