Your team wants to get work done. Someone tries an AI writing tool, connects a scheduling app or adds a meeting assistant. A permission screen appears, they click "Allow," and they get back to work.
As the business owner, you may never see that screen. But you are still responsible for protecting the customer information, business conversations and files that app may now be able to access.
That is an uncomfortable place to be, especially when you are already paying someone to handle your IT.
On October 26, 2026, Tech Rage IT CEO and co-founder Matt Rose joined Amy Kaufeldt on FOX 35's Good Day Orlando to discuss AI security, passkeys and password managers. One part of the conversation deserves a closer look for Orlando and Central Florida business owners: the permissions we give applications, then forget about.
Matt described that permission as a "hall pass." It is a useful way to think about who you have let into your business accounts.
Watch Matt Rose's full FOX 35 interview on AI account security.
The short version
Protecting your accounts means reviewing which apps can access company information, strengthening how employees sign in and using unique passwords where passwords are still required. Your IT partner should be able to explain how those protections are being managed and what needs attention.
What does an app's "hall pass" actually allow?
Some apps need access to another service to do their job. A scheduling tool might need your calendar. An AI assistant might request permission to read email or work with documents.
The permission you approve determines what it can access. Simply using "Sign in with Google" or "Sign in with Microsoft" does not automatically give an app your entire account.
The concern is the access being requested and approved.
For example, imagine an employee tests an AI assistant to help organize email. They approve mailbox access, use it for a week and stop. Months later, nobody remembers whether the connection is still active.
That is the hall pass worth reviewing. Depending on how the connection works, an app can retain approved access without asking for your password each time.
A familiar brand name also does not answer every question. You still need to understand what information the tool needs and whether that use is appropriate for your business.
1. Review which apps have access to company information
Start by asking your IT provider for a review of connected applications and their permissions.
For each app, the review should answer:
- What is it, and who uses it?
- What information can it access?
- Does it need that access for its current purpose?
- Who is responsible for deciding whether to keep it?
Google provides a way to review linked apps through your Google Account. In Microsoft 365 business environments, administrators can review application permissions through Microsoft Entra's Enterprise apps area. A business review needs to consider access approved by users as well as administrators.
Have IT coordinate changes with the people using the apps. Removing an unfamiliar connection without checking could interrupt a legitimate workflow.
Also, removing access does not necessarily erase information an app already received. If a connection looks suspicious, have your IT provider investigate what happened.
What this looks like when it is handled: someone maintains the review process, checks new requests and follows through on changes. You receive a clear explanation of anything that needs a business decision.
2. Use passkeys where they fit your business
Passwords and verification codes can still be stolen through convincing fake sign-in pages. Passkeys help address that problem because they are tied to the legitimate website or app.
To use one, you typically approve a sign-in with a device PIN, fingerprint or face recognition. The biometric check stays on your device.
Passkeys are not always limited to one phone or computer. Some sync through a passkey provider; others stay on a device or security key.
Ask your IT provider where passkeys are supported, how employees will use them and how account recovery will work. Where they are unavailable, keep multifactor authentication enabled and have IT recommend the strongest supported option.
Passkeys protect sign-ins. They do not decide whether an app deserves the permissions someone is about to approve.
What this looks like when it is handled: your team gets a supported sign-in method, clear instructions and a recovery plan before a device is lost or replaced.
3. Make unique passwords practical for your team
Telling employees to remember a different complicated password for every account is a frustrating way to run security.
A password manager can generate and store long, unique passwords. That reduces the risk of a password stolen from one service being reused to access another.
The password manager itself needs protection, including a strong master password where required and multifactor authentication. Recovery options vary, so make sure your team understands the setup your business chooses.
For business accounts, also consider who controls access when an employee changes roles or leaves. Company credentials should be managed in a way the business can maintain.
What this looks like when it is handled: employees have an approved tool and know how to use it, while the business has a process for access changes and recovery.
How does this connect to AI governance?
AI governance means deciding which AI tools your team can use, what company information those tools can access and who approves new requests.
Reviewing connected apps is one part of that process. The goal is to give employees a clear way to use helpful tools while keeping business information under control.
For a small or midsized business, that starts with practical decisions: an approved tool list, clear expectations about sensitive information and someone responsible for reviewing new requests.
Who is responsible for checking all of this?
You should not have to become an account-security specialist to know whether your business is being protected.
You do need an IT partner who can answer three straightforward questions:
- When were our connected apps and permissions last reviewed?
- How are we protecting employee sign-ins?
- Who follows through when something needs to change?
The answers should tell you what has been checked, what still needs work and who owns the next step.
AI gives your team new tools to evaluate. A clear process helps them use those tools without leaving you to chase down the security details.
Get a clear plan for your business accounts
Tech Rage IT is a managed IT services and cybersecurity provider based in Longwood, Florida, serving businesses throughout Orlando and Central Florida.
If you are unsure who has access to your business accounts or who is keeping track, schedule a discovery call. We will talk through your current approach and the next steps toward having your IT handled.
Last reviewed: October 2026
