That tool asked for permission to read files, or see contacts, or access your calendar. It got a yes, because saying yes was the only way to try it.

Nobody wrote that grant down anywhere. It's still active.

This isn't a story about a careless team. It's what happens by default when trying a new tool takes one click and revoking access takes actively remembering it exists. The number of tools touching company data has grown dramatically in the last decade, and small teams are not the exception.

Every one of those tools is a separate relationship: a separate login, a separate set of permissions, a separate answer to the question "what can this actually see." Most companies can name the five or six core tools everyone uses daily. Almost none can name the other ninety.

There are really two different problems hiding inside that number, and they call for different fixes.

The first is scope creep: an app asking for more access than it actually needs to do its job. A scheduling tool that only needs to read your calendar sometimes asks to also send email as you. Most people accept the default permissions without reading them, because the alternative is not being able to use the tool at all.

The second is staleness: access that was legitimate once and was never revisited. A trial nobody converted. A contractor tool from a project that shipped eight months ago. A teammate who switched roles and no longer needs what they were once connected to.