OAuth Detections and Classification

The app shows observed behavioral evidence of acting against the customer's interests, strong enough that an analyst would revoke without further investigation. Signals must be grounded in activity or technical evidence, such as API call sequences whose only plausible explanation is abuse, deceptive impersonation of a legitimate brand, or a publisher tied to confirmed threat activity.

ToS or privacy-policy language alone, even when it discloses data harvesting, resale, or training on customer data, is not sufficient for Malicious. That belongs in Suspicious so a human can judge intent and scope. The bar is intentionally high: false positives here cause unwanted revocations, so when in doubt between Malicious and Suspicious, choose Suspicious.

The app shows trust gaps, anomalies, or adversarial-by-design properties that warrant investigation but are not conclusive enough to confirm active harm. This covers: unknown or low-reputation publisher requesting sensitive scopes, lookalike of a known brand, recent vendor compromise in the news, activity that diverges from the app's stated purpose, and disclosed business-model concerns, such as a privacy policy or ToS that grants the vendor the right to harvest, resell, or train on customer data.

Suspicious is fundamentally about behavior or trustworthiness, not grant shape. If the app behaves consistently with its stated function but was simply granted too much, that is Overprivileged. This is also the conservative default when evidence could support Malicious: a human should review first, and Malicious is reserved for cases where behavioral evidence of harm is already conclusive.

The app is behaving in line with its stated purpose, but its granted OAuth scopes substantially exceed what the app actually needs or uses. Signals: activity logs exercise only a narrow subset of granted scopes, the scopes requested are broader than the app's documented function, or the grant is org-wide for a tool a single team uses.

The natural remediation is re-granting with tighter scopes rather than full removal. The bar versus Suspicious is behavior alignment. If observed activity matches the app's stated function, a scope-vs-need imbalance is Overprivileged. If observed activity is itself off-pattern, it's Suspicious. The bar versus Unnecessary is active use. If the app isn't used at all, classify as Unnecessary regardless of scope shape.

The app is benign and appropriately scoped, but there is no longer a reason to keep it installed. Signals: no meaningful activity over a relevant window, functionality fully covered by another sanctioned app already in use, or the vendor has sunset the product or gone defunct. Removal here is a hygiene action, not a security one. Nothing about the app is wrong. It simply isn't earning its' grant.

The bar versus Overprivileged is whether the app should exist at all. Overprivileged keeps the app and tightens scopes. Unnecessary removes the app entirely. The bar versus Safe is the presence of a specific, articulable reason to remove.

The app comes from a reputable publisher, its granted scopes are appropriate for its stated function, its activity in logs is consistent with that function, and it shows ongoing use that justifies keeping it installed. This is the default classification when no specific concern applies. There is no threat signal, no scope or usage mismatch, and no hygiene issue.

Choose Safe only when you can affirmatively account for the publisher, the scopes, and the activity. An app you cannot make a clean positive case for belongs in Suspicious or Unnecessary depending on whether the doubt is about trust or about utility. Safe is not "absence of evidence of harm." It is "evidence of fit."