To offboard an AI agent, name its owner, list every credential and connection it holds, revoke tokens and rotate shared secrets, remove it from tool and MCP configurations, keep its audit logs, and then test that the old identity can no longer act. OWASP ranks improper offboarding first among non-human identity risks.
Why this gets missed
When an employee leaves, HR triggers a process. When an agent is replaced or a pilot ends, nobody triggers anything. The agent stops being used, but its tokens, service accounts and server connections keep working.
OWASP puts improper offboarding at the top of its 2025 non-human identity list for that reason. A forgotten identity is an unmonitored way in.
The checklist
- Name the owner and the date. Record who approved retirement and when.
- List credentials. API keys, OAuth tokens, refresh tokens, service accounts, certificates and any secrets in a vault.
- List connections. Every MCP server, SaaS app, repository and database the agent could reach.
- Revoke. Revoke active tokens and sessions at the authorization server, not only in the agent's config.
- Rotate shared secrets. If any secret was shared with other systems, rotate it, then update the others.
- Remove from configs. Delete the agent from tool allowlists, MCP client files, CI variables and policy groups.
- Preserve evidence. Keep audit logs and the agent's registry entry for your retention period.
- Test. Try the old credentials. They should fail, and the attempt should appear in logs.
- Close the record. Mark the identity retired, with the date and proof of the test.
Order matters
| Step | Why it comes here |
|---|---|
| Revoke before delete | Deleting config does not kill a token already issued |
| Rotate shared secrets after listing | You need the full list to know what else shares them |
| Preserve logs before cleanup | Cleanup scripts sometimes remove them |
| Test last | It proves the earlier steps worked |
Prevent the next one
Give every agent an expiry or a review date when it is created. Use short lived tokens so a missed revocation fixes itself. Keep one identity per agent, because shared accounts make step 5 painful. Review the inventory on a regular schedule and retire anything with no owner.
The MCP authorization spec also says clients must keep refresh tokens confidential and that servers should not treat refresh tokens as a resource requirement, which is a reminder that long sessions are a choice, not a default.
Safeguard includes agent identity and asset discovery to keep the inventory current, plus a free scan at https://gold.safeguard.sh/scan.
Quick check
Is deleting the agent enough?
No. Tokens already issued may keep working until they expire or are revoked at the authorization server.
How long should logs be kept?
Follow your own retention policy and any legal or contractual requirement. Keep enough history to investigate misuse of the old identity.
Sources
Last reviewed: 19 October 2026.
