Guide
What is shadow AI, and how do you find it in Google Workspace?
Shadow AI is any AI tool employees use for work without IT or security review. In a Google Workspace company, the most common form is an AI app connected with “Sign in with Google”: a meeting recorder, writing assistant, or coding tool that was granted access to company email, files, or calendars.
How common it is
50–80%
of employees use AI tools their employer has not approved
Source: Teramind Shadow AI Report 2026
75%
of employees using unapproved AI have shared potentially sensitive data through it
Source: Teramind Shadow AI Report 2026
Shadow AI vs shadow IT
Both arrive through a work account sign-in nobody reviewed. What changes is what the app does with the access it was given.
Shadow IT
Unapproved SaaS connected with work accounts
File sharing, scheduling, and project tools nobody signed off on. The risk builds slowly: duplicate spend, access nobody remembers granting, and grants that keep working after someone leaves the company.
Shadow AI
AI tools reading company data to do their job
Meeting recorders, writing assistants, and coding agents. These tools don’t wait for someone to upload a file. A meeting recorder joins every call on the calendar it can see. A writing tool with full Drive access can read every document the person can open, and send it to the vendor to process.
What is shadow AI discovery?
Shadow AI discovery is finding the AI tools employees have connected to company accounts without review, and working out what each one can access.
In Google Workspace, every “Sign in with Google” that asks for data leaves an OAuth grant: the app, the person who approved it, and the scopes it was given. Discovery means reading those grants across every user, separating the AI tools from the rest, and translating each scope into plain language.
What the scope actually allows
drive.fileNarrowOnly files the person opened or created with this appdrive.readonlyBroadRead and download every file the person can open in DrivedriveFullRead, edit, and delete every file the person can open in Drivegmail.readonlyBroadRead every email and attachment in the mailboxcalendarFullSee and change every event, including meeting links and attendees
Google OAuth scopes, translated.
How to find shadow AI in Google Workspace
You can do it manually from the Admin console. Here is what that takes at each step, and what AppControler does instead.
1Find connected apps
ManuallyIn the Admin console, go to Security → Access and data control → API controls → Manage Third-Party App Access, then open each app one by one.
With AppControlerOne read-only connection lists every app, how many people use it, and who connected it.
2Work out what each app can access
ManuallyCopy each scope string and look it up in Google's OAuth documentation.
With AppControlerEvery scope is translated into plain English, with a risk level next to it.
3Pick out the AI tools
ManuallySearch each unfamiliar app name to find out what it does and whether it uses AI.
With AppControlerAI tools are separated automatically and checked against a risk database we keep up to date.
4Follow up with people
ManuallyFind who connected the app, message them yourself, and track replies in a spreadsheet.
With AppControlerMessage the person who connected it straight from AppControler.
5Keep the list current
ManuallyRepeat every step every few weeks. New grants appear every time someone clicks Allow.
With AppControlerScheduled rescans pick up new apps without you checking.
6Track renewals
ManuallyKeep contract dates in a spreadsheet and set your own calendar reminders.
With AppControlerUpload the contract PDF. AppControler reads the notice period and alerts you before it closes.
Skip the manual steps. Run your first scan free.
One read-only connection covers all six steps above, and keeps the list current after that.
Read-only access. We never read email or file contents.