The default is usually too generous
Most integrations ask for account-wide access because that is simplest to build. Accepting it means a tool that only needs to draft replies in one mailbox can read years of correspondence across the business.
Nothing has to go wrong for that to be a problem. It is simply a larger blast radius than the task requires.
Scope by job
Grant access per job rather than per system. Enquiry triage needs the enquiry mailbox. Margin analysis needs job and cost records for a period. Tender writing needs the prior submissions folder. Each of those is a narrow, explainable grant.
Read before write
Separate the ability to see from the ability to change. Most valuable early work is read-only: gathering, comparing, drafting. Write access — updating a record, sending a message, publishing a page — should be added deliberately, one action at a time, once the read-only version has proved itself.
Time-bound and reviewable
Permissions granted for a project should expire with it. Permissions granted permanently should be reviewed on a schedule, with a list you can actually read: what is connected, what it can reach, and who approved it.
Least privilege makes AI easier to adopt, not harder
It is tempting to treat this as friction. In practice, narrow access is what makes the first step possible: it is far easier to approve a tool that can see one folder than one that can see everything.
Start small deliberately, and widen it because the work earned it.
Written by the 8ORA team. We publish no customer names, figures or certifications we cannot evidence.