One record type worth adding to the inventory step: AI tools with OAuth grants. Staff connect agents to Google Workspace, Microsoft 365 and GitHub on their own, and those grants often carry full mail or all-repo scope. They never show up as an internet-facing service, so a services-only inventory misses them. The weekly pull is cheap: export the third-party apps list from each tenant's admin console, then record app, account it acts as, scope, owner and last used, in the same YAML shape you suggest. Salt Labs' Manus research this month showed why: one email to a connected inbox reached the Gmail, Drive and GitHub tokens sitting in the same sandbox.