The traffic cop is directing traffic on a road nobody drives anymore

Ask a security practitioner how they prevent data loss and you'll get some version of the same answer: we inspect traffic at the boundary, we categorize destinations, and we block what we don't trust. A traffic cop standing at the intersection, checking every car that passes.

‍

It's a comforting model. It's also describing an Internet that no longer exists.

‍

The uncomfortable truth is that most of your data doesn't pass through your intersection anymore. It moves between clouds you don't control, over connections you didn't provision, authorized by OAuth grants you probably don't know exist. The question worth asking isn't "What data is leaving my boundary?" It's "where does my data exist in the cloud and who and what has access to it?"

‍

That shift, from identifying data in motion to understanding the entitlements behind access, is the single biggest conceptual update security teams need to make. Two changes in Internet architecture forced it.

‍

Shift one: The domain name stopped meaning anything

Network categorization worked when a domain told you something. Salesforce traffic went to salesforce.com. Dropbox traffic went to dropbox.com. You could build allow lists and block lists and feel reasonably confident in them.

‍

Platform-as-a-service broke that assumption, and SaaS-on-SaaS architectures finished the job. The app your marketing team adopted last week might be a thin front end running on Vercel, storing data in Supabase, with auth handled by a third identity provider and half of its backend built on Replit. In this scenario, what does the DNS query tell you? Only that someone connected to a hosting platform used by a hundred thousand other applications, some of them excellent, some of them abandoned side projects, some of them actively malicious. The domain is no longer a proxy for the application, and the application is no longer a proxy for the risk.

‍

Then there's the volume problem. The categorize-then-allow model assumes someone, somewhere, can keep a current judgment on every application your employees might touch. New SaaS and AI tools launch daily. Your vendors' vendors change without notice. Any approach that requires an app to be known, categorized, and judged before a connection is permitted is a treadmill you will never outrun. You'll either block so aggressively that people route around you, or you'll approve so quickly that the categorization is theater.

‍

Either way, the traffic cop is checking license plates on cars that all look identical.

‍

Shift two: Your data moves without ever visiting you

Here's the part that genuinely surprises people. When one SaaS provider integrates with another, the data transfer doesn't route through your network. It never touches your perimeter at all.

‍

The mechanism is OAuth. A user grants Application B access to their data in Application A, and from that moment, B carries the user's identity across the app boundary. The actual data movement happens between the providers' cloud environments: one AWS account talking to another, Google to Azure, region to region. It's a direct exchange between two tenants in public cloud infrastructure, and your inspection point sees none of it.

‍

This is where the old mental model does real damage. The traffic cop approach assumes a hub-and-spoke world: data comes home to your environment, then departs for its next destination, and you observe both trips. The actual architecture is a mesh. Once the grant exists, data flows edge to edge between providers indefinitely, with no checkpoint that belongs to you.

‍

The control point isn't the transfer. The transfer is invisible. The control point is the grant.

‍

The subtle problem: You don't hold the keys

There's a detail buried in how OAuth works that makes this worse, and it's one that most incident response playbooks haven't caught up with. The average employee already holds 88 OAuth grants, 31 of which carry direct access to data. Most security teams couldn't list them if asked.

‍

When your organization issues credentials, you can rotate them. API keys, passwords, certificates: you hold the material, so you can revoke it. OAuth grants between SaaS providers don't work that way. The secret material lives with the providers. Application B holds a token issued by Application A's infrastructure, exchanged provider to provider. Your organization holds nothing. There is no master credential you can rotate to sever these connections at scale.

‍

That's why recent breaches in this category have been so painful. When attackers stole OAuth tokens from the Salesloft Drift integration and used them to pull data out of hundreds of downstream Salesforce environments, the victims couldn't respond the way their playbooks assumed. There was no compromised key to rotate, because the key was never theirs. The connections were long-lived, established months or years earlier, sitting quietly with standing access until someone abused them. Remediation meant finding every affected grant, one by one, across every provider relationship, and revoking each at the source.

‍

Most organizations can't produce that inventory on a good day, let alone during an incident.

‍

The AI security wave is rebuilding the same broken checkpoint

You'd think a lesson this expensive would stick. Instead, watch what the new crop of AI security vendors is selling: prompt inspection proxies, AI gateways, network controls that promise to catch sensitive data before it reaches a model provider. It's the traffic cop again, in a new uniform, standing at a new intersection.

‍

The premise underneath these products is that your sensitive data lives inside your perimeter and the models live outside, so the job is to guard the crossing. That premise was wrong before ChatGPT ever launched. Your sensitive data never started on the far side of the firewall. It has been living in Salesforce, Google Workspace, Slack, and GitHub for a decade. When an AI tool needs that data, it doesn't wait for an employee to paste it into a prompt that conveniently passes through your proxy. It asks for an OAuth grant and reads the data directly, provider to provider, over the same mesh we just described.

‍

So the employee pasting a customer record into a chatbot, the thing these proxies exist to catch, is the visible and least interesting version of the problem. The AI note-taker with standing access to every meeting. The coding agent granted the full repo. The assistant authorized to read the CRM so it can "help with follow-ups." Those connections move orders of magnitude more data than any prompt ever will, and not one byte of it crosses your inspection point.

‍

Agents make the mismatch worse, not better. Per-prompt inspection assumes a human in the loop generating each request at human speed. An agent with a standing grant doesn't send prompts through your gateway. It exercises its entitlement continuously, on its own schedule, for as long as the grant exists.

‍

And note that most AI apps are themselves the purest expression of shift one: a thin front end on a PaaS, wrapping someone else's model API, reachable at a domain that tells you nothing. The category of tooling built to secure AI has managed to inherit both broken assumptions at once.

‍

What the new model looks like

If the transfer is invisible and the credentials aren't yours, the only durable control is the entitlement itself. That means the questions change:

‍

Not "what data is crossing my boundary?" but "what applications and agents hold standing access to my data, and through whose identity?"

‍

Not "should I allow this domain?" but "what did this grant actually entitle, and does anyone still need it?"

‍

Not "how fast can I rotate keys?" but "how fast can I find and revoke a grant across every provider where one exists?"

‍

None of this makes network controls worthless. It makes them insufficient, and it means the center of gravity has moved. The perimeter you can actually govern is the graph of OAuth grants, service accounts, and app-to-app integrations that entitle access to your data, wherever that data lives. It's less visible than network traffic and harder to reason about, which is exactly why attackers got there first.

‍

This is the real shape of the Workforce Edge: not a perimeter you patrol, but a graph of grants, identities, and entitlements spread across every SaaS and AI tool your organization touches.

‍

The traffic cop had a good run. But the roads moved, and the cars stopped needing them. Time to go find out who has keys to the buildings instead.