How to Detect Risky AI Agents in Your Google Workspace

A new class of identity has quietly moved into Google Workspace: the non-human one. AI assistants, automation platforms, copilots, and service accounts increasingly hold standing access to your data and act on it autonomously — reading documents, moving files, sending mail, and sharing content at machine speed. They rarely appear in a traditional user access review, and they almost never get off-boarded. That combination makes them one of the most overlooked risks in modern Workspace security.

This article explains why AI agents are different, what makes one risky, and how to detect and govern them.

Why non-human identities are different

A human identity has natural brakes. People work during the day, touch a bounded set of files, and trigger suspicion when they behave abnormally. A non-human identity has none of those brakes:

• It acts at scale and speed. An agent can read or share hundreds of files in seconds. A mistake — or a compromise — propagates fast.
• It holds standing access. Agents are granted access once and keep it indefinitely. Nobody reviews "does this bot still need full Drive?"
• It is invisible to user reviews. Access reviews enumerate people. Service accounts and agents are easy to skip because they are not on the org chart.
• It blurs accountability. When an agent acts on a user's behalf, whose action was it? That ambiguity complicates both prevention and investigation.

The result is a population of powerful, persistent, under-governed identities sitting on top of your most sensitive data.

What makes an AI agent risky

Not every automation is a threat. A scheduled backup service with scoped access is fine. Risk concentrates where a few factors line up:

• Broad access to sensitive data. An agent that can read all of Drive, or send mail as users, has a large blast radius.
• External or third-party origin. An agent operated by an outside vendor extends trust beyond your boundary.
• Excessive scopes relative to its job. A meeting-notes bot does not need delete access to every file. Over-scoping is the most common and most fixable problem.
• Standing, unmonitored access. Access that nobody reviews and nothing watches is risk with no compensating control.
• Anomalous behavior. A dormant service account that suddenly becomes active, or an agent whose activity spikes far above its baseline, deserves attention even if every permission is technically valid.

How to find the agents you have

Start by enumerating the non-human identities with access to your Workspace:

1. Service accounts. Review the service accounts in your Google Cloud and Workspace environment and what each can reach. Many were created for a one-off task and never retired.
2. OAuth applications acting autonomously. Many "AI" tools connect as OAuth apps with broad scopes. Auditing them overlaps directly with auditing third-party OAuth apps — pay special attention to apps that can act on a user's behalf rather than just read profile data.
3. Automation and integration platforms. iPaaS tools, scripts, and workflow automations often run with wide access under a single identity.

For each, capture three things: what it can reach, what scopes it holds, and whether it has been active recently.

From detection to governance

Finding agents is step one. Governing them is the goal:

• Apply least privilege. Reduce each agent's scopes to the minimum its job requires. This is the highest-leverage move — it shrinks the blast radius of every agent at once.
• Inventory and own them. Maintain a register of non-human identities with an owner for each. An agent with no owner is an agent nobody will retire.
• Watch behavior, not just permissions. Establish a baseline of normal activity per agent and flag deviations — a dormant account waking up, a sudden surge in files touched, access to data the agent never used before.
• Retire the stale. An agent that has not been active in months is pure downside. Off-board it.
• Gate new access. Require approval before a new agent or service account is granted broad scopes, so the population does not grow unchecked.

Why this is becoming core to Workspace security

A few years ago, governing non-human identities was a niche concern. Today, with AI assistants embedded in everyday workflows and automation everywhere, the non-human identity population in a typical Workspace rivals the human one in access if not in headcount. Treating it as an afterthought leaves a large, fast-moving attack surface unwatched.

The path forward is the same posture discipline you apply to human access, extended to machines: discover every identity that can reach your data, map what it can do, judge whether that is appropriate, and watch for behavior that does not fit. It is a natural extension of Google Workspace security and of data security posture management into the agent era.

Questions to ask about every agent

When you encounter a non-human identity with access to your Workspace, a short set of questions quickly separates the benign from the concerning:

• Who owns it? If no human can name themselves as the owner, that is the first finding. Unowned automation is unmanaged automation.
• What is its job, and what does it actually need? Compare the access it holds to the job it does. The gap between them is your over-privilege to trim.
• Is it still in use? An agent that has not acted in months is a candidate for retirement, not renewal.
• Where does it run, and who operates it? An agent operated by a third party extends your trust boundary; that is not automatically wrong, but it should be a conscious decision.
• What would the damage be if it were compromised? The blast-radius question. An agent with full Drive and mail access is a very different risk than one that reads a single calendar.

If you cannot answer these for an agent, you have found exactly the kind of identity this article is about.

The trajectory: more agents, not fewer

It is worth being clear-eyed about direction. The number of non-human identities touching Workspace data is rising fast as AI assistants embed into everyday tools and automation spreads. The governance gap does not close on its own — left alone, it widens. Organizations that get ahead of it now, by building an inventory and applying least privilege while the population is still tractable, will find the problem manageable. Those that wait will be reverse-engineering a sprawl of unowned, over-scoped agents under pressure later.

The work is not glamorous, but it is foundational: know what exists, bound what it can do, and watch what it does. Applied consistently, that turns a fast-moving blind spot into a governed, observable part of your environment — and it folds neatly into the same posture discipline you already apply to human access, so it is an extension of work you are doing rather than a separate program to stand up. The organizations that treat non-human identity as a first-class part of Google Workspace security today are the ones that will not be surprised by it tomorrow.

8200.dev detects the AI agents and service accounts with access to your Google Workspace, maps what each can reach, and flags the risky ones — over-scoped, external, dormant-then-active — alongside the rest of your posture. See how it works.

Want to see which agents can reach your data? Start your free security audit and get an inventory of the human and non-human identities with access to your Google Workspace, ranked by risk.