# Score the authority your agent's credentials carry.

> Score the authority, observability and reversibility of the credentials an AI agent holds, read-only. 204 scopes across twelve providers, unused grants flagged.

Canonical: https://ranwhat.com/scan

ranwhat scan reads the credentials an agent holds, read-only, and scores authority (what it may do), observability (whether a past action can be reconstructed) and reversibility (whether a wrong action can be undone).

```
$ ranwhat demo
```

[Install](https://ranwhat.com/install)

## What it's allowed to do next time.

The watcher tells you [what the agent already ran](https://ranwhat.com/watch). The scanner tells you what it could do next, from the credentials it holds, scored on the three things that determine your exposure.

From `ranwhat demo`, the bundled support-copilot example.

Authority

19/100 · F

Observability

25/100 · F

Reversibility

24/100 · F

- **Least privilege**: **23 permissions granted, 15 never exercised.** Five of those can move money or destroy data: full liability, zero utility.
- **Blast radius**: Unbounded financial authority. 13 irreversible actions reachable with no approval gate.
- **Reconstruction**: Traces don't carry tool name, arguments or credential identity. You can't answer what the agent did on Tuesday, or under whose authority.
- **Evidence grade**: Usage is verified self-attested or unverified per provider, never silently assumed clean.

Catalogued capability semantics for 204 scopes across twelve providers: Google, GitHub, GitLab, Microsoft 365, Slack, Discord, Stripe, Shopify, HubSpot, Atlassian, Sentry and AWS. Unrecognised scopes are classified by action verb and flagged as unclassified, never assumed safe.

[See a full report, as the CLI writes it →](https://ranwhat.com/example-report)

## An example first, then your own credentials.

A profile is a JSON file naming the agent, each credential, the scopes it was granted and the controls around it, in the shape of the bundled example. `live` builds one by asking each provider instead.

```
ranwhat demo                                  the bundled example, no setup
ranwhat scan profile.json --html report.html  score a profile, write a report
read -rs RANWHAT_GITHUB_TOKEN                 paste it: not echoed, not saved to history
export RANWHAT_GITHUB_TOKEN
ranwhat live                                  ask each provider, read-only
ranwhat scan profile.json --pull-usage        which grants were used
```

Pass tokens in the environment as `RANWHAT_<PROVIDER>_TOKEN`. A token passed as a flag still works, but prints a warning: argv is visible to every user on the machine through the process table.

Once you know what an agent can do, [scope the tokens it holds](https://ranwhat.com/guides/ai-coding-agent-security#tokens) down to what it uses.

## Three questions, and one of them can veto.

| Axis | Question |
| --- | --- |
| **Authority** | What is it allowed to do? |
| **Observability** | Can you reconstruct a named past action? |
| **Reversibility** | Can a wrong action be undone? |

Observability vetoes the overall verdict. An agent that cannot reconstruct its own tool calls is indistinguishable from the worst case.

## Which grants were used, and how anyone knows.

| State | Meaning |
| --- | --- |
| Verified | Pulled from the provider's own audit trail |
| Self-attested | Declared in the profile, not independently pulled |
| Unverified | No evidence at all, and the scopes are not assumed safe |

- **Introspection**: Google through tokeninfo, GitHub through the scopes header on an authenticated call, Slack through `auth.test`, and Stripe by key prefix, where an `sk_` key is treated as unrestricted. A token that comes back with no scope list, such as an `rk_` restricted key or a fine-grained GitHub token, is left out of the scores and reported as a high finding, so it is never counted as harmless: declare its scopes in a profile and use `scan` instead.
- **By hand**: To check a token's scopes yourself, provider by provider: [AI agent token scopes](https://ranwhat.com/guides/ai-agent-token-scopes).
- **Usage pulls**: Read-only, over the last 90 days by default (`--window-days`): AWS IAM service last accessed, the GitHub organisation audit log (`--github-org`), Stripe events, and Google Admin SDK reports. There is no Slack pull, so Slack usage is self-attested or unverified.
- **Where tokens go**: Each token goes only to the provider that issued it.