Shadow AI apps

Shadow AI apps are apps that your users connect to company accounts without going through IT or security. Many of them are AI agents that receive an OAuth grant and can then read and act on company data. The Secure Access Monitor (SAM) plugin lets ISPM discover these grants as they happen. Shadow AI that never passes through SSO or an admin approval still shows up in your inventory.

Secure Access Monitor (SAM) plugin

The SAM plugin enables ISPM to do the following:

Capture the OAuth grants users make to apps in managed Chrome browsers, in real time.
Tag the AI-related grants and surfaces them on the Browser OAuth grants page.
Flag grants that carry privileged scopes to critical resource apps, so you can prioritize the riskiest access.

On the Browser OAuth grants page, ISPM shows each grant with the scopes it received, the client app that requested access, the resource app that holds the data, and the browser accounts involved. ISPM marks AI-related grants with an AI label so you can filter to them quickly. You can review the grants, keep the legitimate ones, and revoke or reduce the rest.