OAuth Scope Sprawl: 2D Risk Radar for Third-Party SaaS Apps

Posture Controls

High-risk threshold 55

Admin-scope weight 10

Staleness horizon (days) 120

Posture Readouts

OAuth grants

Flagged apps

Aggregate posture risk

0 / 100

Legend

Read scope

Write scope

Admin scope

Identity provider (SSO hub)

How it works

Each connected SaaS app authorizes via OAuth with one or more scopes at level read (1), write (2), or admin (3). A scope's contribution to risk grows with its grant level and with how long it has sat unused (stale grants are the ones nobody remembers to revoke):

weight(level) = level == 3 ? adminWeight : level == 2 ? 3 : 1
staleness(days) = 0.2 + 0.8 * clamp(days / horizon, 0, 1)
scopeRisk = weight(level) * staleness(days)
appRisk = mean(scopeRisk over app's scopes)
postureRisk = 100 * mean(appRisk over all apps) / adminWeight

Radar distance — apps drift further from the identity-provider hub as their own risk score rises, exactly as an SSPM dashboard ranks apps by posture drift from baseline.
Admin-scope weight slider — models how much an org's policy penalizes admin-level grants versus read/write; raising it pulls high-privilege apps further out and raises the aggregate score.
Staleness horizon slider — the number of idle days after which a grant is treated as fully stale (weight saturates at 1.0); shortening it makes younger grants count as risky sooner.
High-risk threshold — apps whose risk score crosses it get a pulsing red ring, the same triage a security team applies before a manual review.
Enforce Least Privilege — downgrades every admin scope on the selected app to write and refreshes its last-used clock, mirroring an SSPM auto-remediation policy.
Revoke Selected App — removes the OAuth grant entirely, the same action as pulling an app from the SSO admin console.

Drag to pan · scroll to zoom · click an app node to select it