To revoke an AI agent’s access, stop it from running, then disable or revoke every identity, credential, permission grant, token, and session it can use—at the system that issued or accepts each one. Disabling the agent’s account or signing it out may not invalidate tokens or sessions at connected services. Verify each service rejects the old access before treating the agent as contained or retired.
Why disabling one account may not be enough
An AI agent is a workload with potentially several separate ways to reach tools and data, not just a chatbot login. NIST describes agent identities and authorization as a cross-system problem, while its identity guidance warns that access and refresh tokens may remain valid after an authentication session ends. Treat each connection as a separate access path and close it at the system that issues or accepts it.
| Access path to inventory | Where to close it |
|---|---|
| Service or workload identity | Disable or deprovision it at the identity provider and at services that maintain their own identities or permissions. |
| API keys, passwords, or other secrets | Revoke or invalidate them at the issuing service. Remove exposed copies from code, configuration, logs, vaults, and deployment environments as appropriate. |
| OAuth grants and connected-app permissions | Remove or revoke the grant at the identity provider or connected service; disabling a login method is not the same as removing authorization. |
| Access and refresh tokens | Revoke them at the issuer or relying service where supported, and check the provider’s documented behavior and propagation time. |
| Sessions | Terminate sessions separately at the identity provider and at each relying service that offers its own session controls. |
| Signing credentials and secrets stored by tools or infrastructure | Revoke or rotate the credential at its issuer, then check the agent runtime, connected tools, and deployment systems for usable copies. |
NIST’s guidance explains why central logout is not proof of global revocation: an access token and associated refresh tokens can remain valid after the authentication session ends, and identity-provider and relying-party sessions are terminated independently. A token holder may be able to present that token, so treat an exposed token as a credential, not merely as evidence of a past login. See NIST SP 800-63B and NIST’s explanation of why agent identity needs strong foundations.
If the agent may be compromised: contain it first
Prioritize stopping further use of the agent’s access, then investigate. NIST SP 800-63B says compromised authenticators should be suspended, invalidated, or destroyed promptly after detection; OWASP says exposed keys should undergo immediate revocation.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Stop execution and automated restart. Isolate or stop the agent runtime and prevent scheduled jobs or deployment automation from bringing it back while you contain the incident. This is an operational containment step; there is no single stop command that applies to every agent platform.
- Use a trusted administrator identity. From a device and account you believe are uncompromised, suspend the agent identity and revoke its credentials and permissions. Do not rely on the agent itself, or on credentials accessible to it, to perform containment.
- Revoke each access path at its issuer or target. Revoke API keys, tokens, OAuth or connected-app grants, service identities, and relevant signing credentials. Where a target service accepts or stores credentials independently, use its own controls as well as the issuer’s. Provider controls and propagation differ, so do not assume one revocation action reaches every service.
- Terminate sessions separately. Sign out or terminate sessions at the identity provider and at each connected service where those controls exist. A central logout alone does not establish that relying-party sessions have ended.
- Replace only credentials still needed for authorized work. Create narrowly scoped replacements after the exposed credential has been revoked. Remove exposed copies from accessible code, configuration, logs, and systems, while preserving incident records and log integrity. OWASP’s Secrets Management Cheat Sheet covers revocation, rotation, and lifecycle logging.
- Review use and look for other paths. Check available credential and service usage history, determine who or what accessed the secret and when, and look for other credentials or copies the same agent could use. Alert on attempted reuse of revoked values where your systems support it.
- Test the old access directly. Make a controlled request to each relevant API or service using the revoked credential, or use that provider’s documented revocation check. Confirm it is rejected; record any propagation delay or service-specific exception rather than assuming revocation was immediate.
When retiring an agent: deprovision every connection
Retirement is planned cleanup rather than emergency containment, but it still requires closing each path rather than just hiding or deleting the agent in its main interface.
- Use the access-path inventory above. Include connected apps, service identities, permissions, secrets, scheduled jobs, and sessions—not only the agent’s primary account.
- Disable or deprovision the identity and remove delegated grants. Close the agent’s permissions at each connected service, including services that maintain their own grants or identities.
- Revoke outstanding credentials and terminate sessions. Apply the relevant issuer and relying-service controls, then remove secrets no longer needed from vaults, deployment configuration, and agent environments in line with retention and incident-record policies.
- Verify and document closure. Test that target services reject the retired identity and credentials, and record the status of each access path so an unclosed connector is visible.
SCIM can support identity provisioning, deprovisioning, and lifecycle operations across systems when the environment and connected products support it. It is not itself an authentication or authorization mechanism, and support does not mean every permission, token, or session is revoked automatically. NIST’s February 2026 NCCoE concept paper discusses SCIM alongside OAuth 2.0/2.1, OpenID Connect, and SPIFFE/SPIRE as relevant identity and authorization approaches; it is a concept document, not a claim of universal product support.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Know which control you are revoking
| Control | What it does | What it does not establish |
|---|---|---|
| Authenticator | Proves or supports the agent’s identity, such as a login credential or other authentication method. | Removing it alone does not necessarily remove service permissions or invalidate tokens already issued. |
| Authorization grant | Permits an identity or application to do particular things at a service. | Disabling the identity is not proof that every separately stored grant has been removed. |
| Session | Represents an authenticated interaction maintained by an identity provider or relying service. | Ending one party’s session does not prove sessions at other parties have ended. |
| Token | Can convey or support access to a service; access and refresh tokens may outlive the original sign-in session. | Signing out does not by itself prove that issued tokens are invalid. |
| Revocation | Disables an exposed credential or permission where the relevant issuer or service supports revocation. | It is not the same as issuing a replacement credential. |
| Rotation | Issues a new credential for continued authorized work and replaces the old value. | It does not neutralize an exposed old value unless that value is also revoked or otherwise invalidated. |
For additional implementation guidance on protecting identity tokens, access tokens, and assertions across SSO, federation, and API scenarios, see the final NIST IR 8587 publication record, finalized September 15, 2026. Its lifecycle and token-verification guidance informs implementation, but each provider’s own controls and documented token behavior determine what a particular revocation action actually closes. OWASP’s AI Agent Security Cheat Sheet is another reference for agent-specific security practices.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
