37 Continuous OAuth re-authorization sweeps

A scheduled sweep that snapshots every live OAuth grant in the tenant, diffs it against the approved-app register, sets the access decision in the console for anything unapproved so the grant cannot simply be re-issued, and then revokes it per user. It catches the app a user consented to last week and the malicious client an attacker authorised after a phish — neither of which shows up in any settings screen. The diff is routed to the security mailbox, so the sweep is continuous rather than a one-off.

Documentation: How authorized access works ↗ · OAuth log events ↗

Caveats

Revoking a token without blocking the app in API controls is a treadmill¹
‘Trusted’ in API controls means the app gets ALL OAuth scopes, including restricted ones²
Internal Apps Script and service-account grants do not always appear as third-party tokens³

Setup steps

Snapshot every live OAuth grant in the tenant to a local, dated CSV — the next step diffs it locally, so it must not disappear into Drive.
```
gam all users print tokens > tokens-$(date +%F).csv
```
Method: tokens.list ↗
open ↗
https://admin.google.com/ac/owl · captured 2026-07-15

Compare the snapshot against the approved-app register; any client id not on the register is a finding.

comm -13 <(sort apps-register.csv) <(cut -d, -f<clientid-column> tokens-$(date +%F).csv | sort -u)
open ↗
https://admin.google.com/ac/owl/list?tab=configuredApps · captured 2026-07-15
Security › Access and data control › API controls › Manage Third-Party App Access
For each unapproved client ID, set its access decision in the console — the app-access list №8 maintains — so the grant cannot simply be re-issued after you revoke it.

App access
Blocked (or Limited to unrestricted Google services)

Control which apps access Google Workspace data ↗
open ↗
https://admin.google.com/ac/sc/investigation · captured 2026-07-15

Revoke the surviving unapproved grants per user.
```
gam user <user> delete token clientid <clientid>
```
Method: tokens.delete ↗ Manage a user's security settings ↗
Schedule the sweep so it is continuous rather than a one-off, and route diffs to the security mailbox. Optionally, commit each run's output to a private GitHub repo and have a Claude Routine review the diff for suspicious changes — new grants with broad scopes, re-grants of blocked clients — and decide per finding whether to escalate to an admin by email or push notification.
```
cron: daily or weekly; output diffed against apps-register.csv (optionally: git commit + scheduled Claude review of the diff)
```

Ongoing maintenance

automatable: script Weekly: run the token snapshot and diff against the approved-app register.
automatable: AI agent Weekly: review the diff for new grants with broad scopes or re-grants of blocked clients.
requires a human Per finding: decide block/revoke and execute it.

How to verify

Check the newest sweep artifact is within the cadence and the diff was reviewed — then re-run the snapshot and confirm it matches.
```
gam all users print tokens > tokens-verify.csv && diff <(sort tokens-verify.csv) <(sort tokens-<last-date>.csv)
```

Further screens

Admin console screen — Directory > Users > [user] > Security > Connected applications (per-user token review) — https://admin.google.com/ac/users captured 2026-07-15

v0.1.2Detect policy #29 · #19, #33 ↗