Execution Boundary Case Study

Shadow AI — The Missing Execution Boundary

The problem isn't the AI tool. The problem is that OAuth connections execute without an execution boundary.

Employee connects AI SaaS tool via OAuth
WITHOUT EXECUTION BOUNDARY
Most organizations today
👤  EMPLOYEE ACTION
Connects AI productivity tool
🔗  OAUTH GRANT
"Allow access to Drive, Email, Calendar"
⚡  API ACCESS ACTIVE
Full read/write to internal data
📤  DATA EXFILTRATED
Confidential documents processed by third-party AI
🔍  POST-HOC DISCOVERY
Security team finds OAuth token weeks later
WITH EXECUTION BOUNDARY
Authority state attested at connection
👤  EMPLOYEE ACTION
Connects AI productivity tool
◆  Execution Boundary  ◆
Connector Authority
Is this SaaS tool approved for org use?
Scope Validation
Read-only vs. read/write — exceeds policy
Data Classification
Requested access includes confidential folders
Risk Threshold
Third-party AI + confidential data = escalation