Recommended Free Tools
Audit a third-party AI agent as a software identity with delegated access—not just as a vendor whose privacy policy you have read. Trace what it can access, which identity and credentials it uses, what actions it can take, where those actions are enforced, and what evidence the system keeps. A connection that appears to be for answering questions about files may also have authority to edit, delete, send, or share them.
This matters because an agent can combine data access with tools that act on a user’s behalf. NIST’s February 5, 2026 NCCoE announcement identifies access to diverse data, tools, and applications as a risk area, and names identification, authorization, auditing, non-repudiation, and prompt-injection mitigation among the relevant issues. A useful audit therefore follows the whole chain: agent, identity, connected application, data, tool call, and resulting action.
As an Amazon Associate I earn from qualifying purchases.
What a third-party AI agent audit should establish
The purpose of an audit is to determine whether the agent’s actual access and behavior fit its approved task—and whether your organization can detect, investigate, and stop activity that does not. A vendor’s description of intended use is not proof that the technical permissions are limited to that use. Inspect what the identity can do in connected services and what the application enforces when the agent retrieves information or invokes a tool.
NIST’s February 2026 NCCoE announcement puts the issue plainly: “realizing these benefits requires understanding the potential risks from giving AI agents access to diverse data sets, tools, and applications, and applying appropriate identification and authorization controls to mitigate these risks.” The project is a proposal and ongoing work, not a complete final implementation standard. Use it to understand the risk areas, while making your own control decisions against your systems and obligations.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Define the boundary before reviewing permissions
Include the agent and every connected component that can affect its access or actions: the third-party service, OAuth or other application connection, service account, identity provider, API, retrieval system, external tool interface, and the human or service owner. Where the agent uses MCP or another external tool interface, include that interface and the tools, data sources, and services it exposes. NIST describes MCP as a way for agents to discover and interact with external tools, data sources, and services.
Distinguish what the agent can technically do from what your organization has approved it to do. Those may differ. The audit should document both, identify any gap, and assign a person responsible for closing it.
Step 1: Inventory agents, integrations, data, and owners
Start with a complete inventory, rather than with a list of agents that employees remember installing. Include approved deployments, experiments, integrations embedded in other services, and connections that may have been created by individual users. Unknown, duplicate, and ownerless connections are findings to investigate, not entries to assume are harmless.
| Record | What to capture | Why it matters |
|---|---|---|
| Agent and vendor | Name, provider, deployment or tenant, environment, and accountable internal owner | Identifies what is being reviewed and who can approve or disable it. |
| Purpose | Specific business task, expected users, and the boundaries of the approved use | Provides the basis for deciding whether a permission or action is necessary. |
| Connected applications and data | Each connected service, repository, mailbox, channel, data source, and relevant data class | Shows which information could be exposed through the integration, directly or through retrieval. |
| Tools and endpoints | Available functions, APIs, MCP servers, and other external tool interfaces | Tools can turn information access into actions such as sending, changing, or sharing data. |
| Identity and authority | Whether the agent uses its own identity, a service identity, or a person’s session; record the owner and any delegation | Establishes whose authority is exercised and whether activity can be attributed. |
| Lifecycle status | Approval, last review, active or inactive status, and a contact for removal | Helps locate stale access and makes revocation operationally possible. |
Compare the inventory against the organization’s available application-connection or identity records. Ask system and data owners to confirm that each connection is recognized and still needed. If an integration cannot be assigned to an owner or tied to a current purpose, restrict or suspend it while its status is resolved, following your organization’s incident and change procedures.
Step 2: Compare every permission with the agent’s task
Review the permissions granted by each connected application and the actions exposed by each tool. Record data access and action authority separately. “Can read files” is not equivalent to “can manage files,” and a tool that can send a message has a different impact from one that only drafts a response.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Permission or action | Audit question |
|---|---|
| Read or retrieve | Which users’ or teams’ data can the agent read? Can it retrieve content beyond the requester’s own entitlement? |
| Create | Can it create documents, records, tickets, or other content? Where does that content appear? |
| Update | Can it change existing data, metadata, permissions, or records? |
| Delete | Can it remove data, and is deletion reversible or subject to approval? |
| Send or publish | Can it send email or messages, post content, or otherwise communicate externally or to a group? |
| Share or export | Can it grant access, create share links, download, export, or move data to another system? |
| Administrative | Can it change users, integrations, policies, settings, or other controls? |
For each permission, write down the task that requires it, the resources it covers, and whether it is needed continuously or only for a specific operation. Remove permissions with no clear task justification. Prefer read-only access when reading is enough; require an explicit approval or another suitable control for higher-impact actions. Separate scopes or tools where possible so that a routine read task does not inherit write or delete authority.
OWASP’s DevSecOps Guideline, “AI Agent and MCP Security,” describes this as least agency: “The guiding principle is least agency: give an agent only the autonomy, tools, and access its task requires, for only as long as it needs them.” OWASP’s Gen AI Security Project also describes the failure mode in LLM06:2025: “An LLM agent has access to extensions which include functions that are not needed for the intended operation of the system.” Its example is an extension with repository read access that also has modify and delete ability. The practical test is not whether the broad permission is convenient; it is whether the documented task genuinely requires it.
Check both the application grant and the agent’s available tools
A permission review has two layers. First, inspect the grant at the connected service or identity provider: scopes, resources, users, and actions allowed to the application. Second, inspect the functions the agent can actually call, including tools made available through external interfaces. A narrow-looking interface does not compensate for a broad underlying grant, and a broad tool list can expose actions the business task does not need.
Record the effective result, not only a label such as “Drive access” or “mail integration.” Identify whether access is limited to selected files or accounts, or instead inherits a user’s broader access. If the platform does not expose enough detail to establish the boundary, treat that as an unresolved risk and seek a verifiable configuration or narrower integration.
Step 3: Verify the identity and credential lifecycle
Determine exactly how the agent authenticates. It may act as a distinct agent identity, use a service account, or operate through a person’s session or credentials. These patterns affect least privilege, attribution, continuity when staff change roles, and how quickly access can be revoked. Prefer a distinct, attributable identity where the system supports it, and avoid making the agent’s activity indistinguishable from a human user’s ordinary work.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
For each credential or token, record its type, scope, lifetime, storage location, renewal mechanism, rotation process, and revocation path. Confirm who can access or renew it, whether it can be reused outside the intended integration, and what happens when the owner leaves or the agent is decommissioned. Avoid long-lived reusable secrets where the architecture supports safer identity and credential lifecycles.
NIST’s August 2026 identity blog notes that long-lived API keys or tokens are often used in proofs of concept and discusses OAuth 2.0 and SPIFFE in the context of enterprise identity. NIST’s September 2026 token report addresses token protection, verification, key management, and lifecycle controls. These are relevant design considerations, not proof that a particular implementation is secure. For federated deployments, OWASP AISVS calls for minimal-scoped, short-lived signed tokens. Check that the deployed configuration—not merely the architecture diagram—matches the intended scope and lifecycle.
Make revocation a testable procedure
Write down the control-plane action that disables the connection or identity, the person authorized to perform it, and any dependencies that must also be removed. A vendor-side disconnect may not by itself invalidate credentials or remove grants in a connected application. Test the organization’s revocation path in an approved environment, then verify that the agent can no longer access the relevant service. Document how you would preserve and review available logs before or during an emergency shutdown, in line with your incident process.
Step 4: Test authorization where the agent retrieves data and acts
Configuration review cannot establish that authorization is enforced throughout execution. Verify where decisions happen: in the connected application, identity provider, API, retrieval layer, tool, or a policy enforcement point. Controls described only in a prompt or vendor documentation are not substitutes for access checks that are enforced in the execution path.
OWASP AISVS says authorization context should be enforced through AI retrieval and inference pipelines. In practical terms, test whether a user’s entitlement is preserved when the agent searches, retrieves, summarizes, or passes content to another tool. Test whether the agent can invoke a function with authority it should not have. These checks should use controlled accounts and approved test data; do not expose live sensitive records in an experiment without authorization.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Choose a bounded test environment. Use a test tenant, synthetic records, or other approved test data. Identify the test owner, allowed actions, and stop conditions before exercising the agent.
- Test the normal task. Confirm that an entitled user can complete the intended read or action and that the resulting data and action are limited to the approved purpose.
- Test an authorization boundary. Use a test identity that should not have access to a selected record or data area. Confirm the agent cannot retrieve or infer that content through search, summaries, cached context, or a connected tool.
- Test excess actions. Attempt to invoke a write, delete, send, share, or administrative function that the task does not require. A refusal in the model’s prose is not sufficient evidence if the underlying API still accepts the call.
- Test malicious content safely. In a controlled exercise, place adversarial instructions in test content that the agent may encounter. Check whether the agent treats that content as untrusted input, attempts unauthorized retrieval, or invokes a tool beyond the approved task.
- Inspect enforcement evidence. Confirm that denied requests are blocked at an authoritative system boundary and that the event can be associated with the test identity and relevant tool or resource.
Prompt injection matters because an agent may encounter instructions embedded in data it is allowed to read. An attacker or a malicious document may try to steer it toward exposing information or misusing an available tool. The key distinction is between the agent being persuaded to try an action and the system permitting that action. Test whether authorization remains effective even when the model receives hostile or irrelevant instructions; do not rely on a prompt telling the agent to ignore them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 5: Check logs, evidence, and incident readiness
Logs should let an investigator reconstruct what happened across identity, authorization, data access, and tool execution. For a representative action, check whether records can answer these questions:
- Which agent, service identity, or human identity initiated the action?
- Under whose authority was it acting, and which permission or policy applied?
- Which data resource, application, or tool was accessed?
- Was the request allowed or denied, and what action resulted?
- When did the event occur, and can related events be correlated across systems?
- Can an authorized investigator retrieve the evidence without allowing the agent or an untrusted user to alter it?
Review visibility for reads as well as consequential actions. A log that records only successful writes may not reveal unauthorized retrieval attempts or denied tool calls. Check monitoring and alerting for events that matter to the organization, such as unexpected access, new connections, or high-impact actions. Decide who can see the logs, how they are protected, and how retention is set under applicable organizational and legal requirements.
The reviewed guidance identifies auditability, monitoring, non-repudiation, and token lifecycle as concerns, but it does not establish one universal event schema or retention interval. Set those controls according to the sensitivity of the data, likely impact, investigation needs, and requirements that apply to your organization. Avoid treating a generic vendor activity page as sufficient until you verify that it contains the identity, authority, resource, action, and timing details you need.
Free tools Windows power users keep installed
One-click scans. No signup required.
Connect audit findings to response actions
For each material finding, define who can restrict the agent, revoke credentials, remove the application grant, disable an exposed tool, and notify affected owners. Decide how evidence will be preserved and how to determine which resources may have been accessed. Keep this procedure aligned with the organization’s incident response process; an audit log is useful only if responders can access and interpret it when needed.
Step 6: Compare control options by capability
No product or vendor is established as a required solution by the guidance discussed here. When assessing your existing controls or considering an implementation, compare capabilities rather than relying on category names or product claims.
| Control dimension | What to verify | Why it affects the audit |
|---|---|---|
| Identity attribution | Can records distinguish the agent, human user, service owner, and delegated authority? | Clear attribution supports accountability and investigation. |
| Permission granularity | Can access be limited by data source, action, user, and task? | Fine-grained scopes make it easier to grant only necessary authority. |
| Enforcement point | Are decisions enforced at API, data, retrieval, and tool invocation time? | Runtime checks can block an action even if the model attempts it. |
| Credential lifecycle | Are credentials protected, short-lived where feasible, rotated, and revocable? | Lifecycle controls limit the time and scope of exposure if a credential is compromised or no longer needed. |
| Visibility | Can the organization observe data reads, tool calls, denials, and consequential actions? | Coverage determines whether misuse can be detected and reconstructed. |
| Evidence quality | Can records connect identity, authority, resource, action, and time? | Linked evidence makes investigation more reliable than isolated event records. |
Enterprise identity and access management, OAuth application inventory, and security monitoring are implementation categories that may help address these needs. Assess the actual capabilities, integration boundaries, and procurement fit for your environment; a category label alone does not establish that a control meets the requirements.
Step 7: Remediate findings and repeat the review
Prioritize gaps according to the data at risk, the breadth of access, and the impact of actions the agent can take. An agent with broad read access to sensitive content and a path to external sharing deserves different treatment from a narrowly scoped read-only assistant. Make each remediation verifiable: identify the permission or enforcement point changed, who approved the change, and how you confirmed the new effective access.
- Excess permissions: remove unneeded scopes and actions; confirm the task still works within its approved boundary.
- Unclear ownership or purpose: assign an accountable owner and document the approved use, or suspend the connection until it is justified.
- Human credentials or shared identity: assess whether a distinct, attributable agent or service identity can replace them; update monitoring and revocation procedures accordingly.
- Weak runtime enforcement: restrict the connected grant or tool while authorization checks are corrected and tested at the relevant boundary.
- Insufficient audit evidence: identify which identity, authorization, access, or action detail is missing and determine how to collect it before relying on the integration for sensitive work.
- Unverified revocation: test the disablement path and confirm the connected application no longer accepts the agent’s access.
Repeat the review on a defined schedule and whenever the agent gains a new integration, permission scope, model capability, tool, or business purpose. Changes to the connected application can also alter effective access, so review the whole chain rather than just the agent’s settings. NIST’s agent authorization work is still developing; distinguish controls your organization has implemented today from emerging guidance, and verify current standards and local requirements when making compliance decisions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
