AppControler
Start scan

Shadow AI discovery · Spot and score

See every app connected to your Google Workspace

Who connected it, what it can access, and which ones are AI tools worth a second look. One read-only scan, no agents.

Start a free scanBecome a design partner

Read-only access. We never read email or file contents.

Connected apps

64 apps · 9 AI tools · 2 high risk

  • Otter.ai

    Meeting notes

    Calendar · Full accessHigh

  • Superhuman

    Email client

    Gmail · Full accessHigh

  • Read.ai

    Meeting assistant

    Calendar · ReadMedium

  • Gamma

    Presentations

    Drive · Per-fileMedium

  • ChatGPT

    AI assistant

    Profile · BasicMedium

  • Claude

    AI assistant · Team plan

    Profile · BasicLow

What you get

Four things the Admin console won't tell you at a glance

01

Every connected app

Each third-party app people authorized with their work Google account.

02

Who connected it

The people behind every grant, and how many use each app.

03

What it can access

Every OAuth scope, translated into plain English.

04

Which ones are AI

AI tools pulled into their own list with a risk level.

Score

Scopes translated into plain English

drive.readonly and drive look almost the same on a consent screen. AppControler shows what each one actually allows, with a level next to it.

  • Per-file, read-only, and full access told apart
  • Gmail, Drive, Calendar, and Contacts scopes covered

What the scope actually allows

  • drive.fileNarrowOnly files the person opened or created with this app
  • drive.readonlyBroadRead and download every file the person can open in Drive
  • driveFullRead, edit, and delete every file the person can open in Drive
  • gmail.readonlyBroadRead every email and attachment in the mailbox
  • calendarFullSee and change every event, including meeting links and attendees

Google OAuth scopes, translated.

Spot the AI tools

AI tools separated from the rest of your apps

Meeting recorders, writing assistants, and coding agents get their own list, checked against a risk database we keep up to date.

  • Risk levels: High, Medium, Low
  • Category for every tool
  • New AI tools added to the database as they appear

AI tools · 9 of 64 apps

  • Otter.ai

    Meeting notes

    High

  • Superhuman

    Email client

    High

  • Read.ai

    Meeting assistant

    Medium

  • Cursor

    Coding agent

    Medium

  • Claude

    AI assistant

    Low

Decide

Mark each app Approved, Review, or Blocked

Record your team's decision on every app so everyone sees the same list. Change it in the dashboard, from Slack, or by asking Claude.

Policy

  • Claude

    Allowed at your company

    Approved

  • Read.ai

    Needs a look before you decide

    Review

  • Superhuman

    Not allowed at your company

    Blocked

Coverage

What discovery sees, and what it doesn't

Sees

  • Apps connected with "Sign in with Google" on a work account
  • Every person who authorized each app
  • New apps on every scheduled rescan

Doesn’t see

  • AI tools used in a browser with a personal account
  • Browser extensions and desktop apps
  • Personal API keys

New to the topic? Read what shadow AI is and how to find it.

FAQ

Common questions

How does AppControler find shadow AI in Google Workspace?

It reads the third-party OAuth grants in your Workspace through read-only Admin SDK access. Every app a person authorizes with their work account leaves a grant with the app name, the person, and the scopes. AppControler lists them, translates the scopes, and flags the AI tools.

Does it read our email or files?

No. Discovery only reads which apps people authorized and what scopes they hold. It does not read Gmail message bodies or Drive file contents.

How is the risk level decided?

Each AI tool is checked against a risk database we keep up to date, and weighed against the access it was actually granted in your Workspace. An app with full Drive or Gmail access ranks higher than one that only sees a basic profile.

What do Approved, Review, and Blocked mean?

They are your team's decisions for each app. Approved means it is allowed, Review means someone should take a look, and Blocked means it is not allowed at your company. You can set them in the dashboard, from Slack, or from Claude and ChatGPT over MCP.

How often is the list updated?

On the Free plan you run a sync when you want one. On Pro, scans run on a schedule, so new apps show up without you checking.

More features

The rest of AppControler

SteerSlack alertsAlerts in your channel, a direct question to whoever connected an app, and answers from slash commands.Learn more
RenewRenewal trackerUpload the contract and get alerted before the notice window closes.Learn more
AskMCP for Claude & ChatGPTAsk Claude, ChatGPT, or Cursor about your apps, people, policies, and renewals.Learn more

Find out which AI tools are connected to your Workspace.

Your first scan is free. Connect Google Workspace with read-only access and get the full list.

Run my free scanBecome a design partner

Read-only access. We never read email or file contents.