Standing Access: The Apps That Can Still Speak in Your Name
Photo: George Chernilevsky, Public domain, via Wikimedia Commons
Most professionals treat their profile as a document they control. In practice, it is closer to a shared workspace. Every time you connect a scheduling tool, a resume parser, a social media dashboard, or a browser extension, you extend an invitation to act on your behalf. The invitation is technical rather than social, but the consequences are reputational all the same.
OAuth, the protocol behind nearly every "Sign in with Google" or "Connect your LinkedIn" button, was designed to avoid sharing passwords. It replaces them with scoped tokens: limited credentials that permit specific actions. The limitation is real, but so is the duration. Many tokens renew silently, and many integrations remain authorized long after the task that justified them has ended. The result is a quiet accumulation of standing access, distributed across accounts you may not have reviewed in years.
The Delegated Voice
When an application can post as you, it borrows your credibility. That is the useful case: a scheduling link that updates your calendar, a publishing tool that distributes an article, a customer relationship platform that logs a meeting note. Each of these saves time precisely because it operates inside your identity rather than beside it.
The same mechanism, left unattended, can produce messages you did not write, endorsements you did not intend, and data flows you did not authorize. A dormant integration is not neutral. It holds a key. Whether anyone still uses that key is a separate question from whether the lock still opens.
For professionals, the risk is less dramatic than a hijacked account and more mundane than a breach. It is the slow drift of a personal brand into territory its owner no longer supervises. A tool that once shared job updates may now be configured to publish automatically. A plugin abandoned by its developer may still hold read access to your connections. Neither event announces itself.
How Permissions Outlive Their Purpose
Delegated access tends to accumulate in three ways. The first is convenience: a tool connected for a single project is never disconnected because disconnecting takes effort and the tool might be useful again. The second is scope creep: applications often request broader permissions than their visible function requires, and users approve the bundle rather than the individual scopes. The third is organizational change. A tool authorized by an employer, a team, or a predecessor may persist on a personal account long after the relationship ends.
None of these is a failure of character. They are failures of visibility. Permission screens are typically buried several menus deep, and revocation is rarely presented as a routine maintenance task. The remedy is to treat access reviews the way you treat password changes: not as an emergency response, but as a scheduled obligation.
A Practical Audit, Platform by Platform
Begin with the platforms that carry the most professional weight. The exact menu labels shift over time, but the structure is consistent across major providers.
Open Settings & Privacy, then navigate to Data privacy and Permitted services. This list shows applications authorized to access your account. Review each entry for the scope of access and the last time it was used, where that information is available. LinkedIn also maintains a separate list under Other applications in some account configurations, so check both. Revoke anything you do not recognize or no longer use.
Visit myaccount.google.com/connections to see third-party apps with account access. Pay attention to the distinction between applications that merely use Google to sign you in and those that can read, compose, or delete data in Gmail, Drive, or Calendar. A sign-in credential is comparatively low-risk; an application with mail access is not. Google also surfaces recent security activity, which can help you identify integrations you have forgotten.
Microsoft
Microsoft account holders can review consented applications at account.live.com/consent/Manage. For organizational accounts, an administrator may control consent settings, so personal and work identities should be audited separately.
Social and Publishing Platforms
X, Meta, and similar networks maintain their own app authorization pages under security or privacy settings. These are often the most consequential, because publishing permissions are frequently bundled with analytics and advertising access. If a dashboard can post on your behalf, confirm that you still want it to.
Browser Extensions and Mobile Apps
Do not overlook the software installed on your devices. Extensions that request access to pages you visit can read profile content and, in some cases, act within authenticated sessions. Review installed extensions periodically and remove those whose developers are unknown or whose updates have stopped.
Triage: Revoke, Reauthorize, or Retain
Revocation is not always the right answer. Some tools are genuinely useful, and removing them creates friction you will resent. A better approach is triage.
Retain integrations you actively use and whose permission scope matches their function. Revoke anything you cannot identify, anything tied to a defunct service, and anything whose access exceeds what its purpose requires. Reauthorize tools that are useful but over-permissioned, granting the narrowest scope the platform offers. Many providers now allow read-only or publish-only access; choose deliberately rather than accepting the default bundle.
After revoking access, check whether the tool left residual data or scheduled posts behind. Some platforms allow you to remove the app entirely, while others only invalidate the token. Where possible, delete the connection from both sides: the platform's permission list and the application's own account settings.
Making the Review Routine
A quarterly review is sufficient for most professionals. Block twenty minutes, work through the platforms in a fixed order, and keep a short record of what you revoked and why. The record matters less for compliance than for memory; next quarter, you will want to know which tools you deliberately kept.
Pair the review with other recurring hygiene tasks: updating recovery contacts, checking connected devices, and confirming that your public profile still reflects your current role. Access management is not a separate discipline from personal branding. It is the plumbing beneath it.
What Good Access Hygiene Buys You
The professional value of an access audit is not secrecy. It is coherence. When you know which applications can speak in your name, you can make a credible claim about what your profile represents. You can answer a recruiter's question about a post you do not remember publishing. You can explain, if necessary, why a connection exists.
Your digital identity is increasingly defined by the systems authorized to touch it. Treat that authorization as an asset worth supervising, and the occasional cleanup becomes a form of career maintenance rather than a chore.
