AI Agent Decommissioning Checklist: Proving a Retired AI Pilot Is Actually Off
When an AI pilot is cancelled, the agent's identity usually is not. In an August 2026 EMA survey of 202 enterprise IT and security leaders — commissioned by Cequence Security — 30% of the agentic AI pilots that never reached production had been paused indefinitely, discontinued or abandoned, and the report states most were not cleaned up, leaving the credentials and production access they were provisioned with still in place.
Two qualifiers matter. The denominator is only the pilots that did not reach production: 18.8% paused indefinitely plus 11.9% formally discontinued or abandoned — not a share of all agentic AI pilots. And “most were not cleaned up” is the report's own directional statement; no source publishes a percentage of abandoned agents still holding live credentials. Enterprise Management Associates (EMA) fielded the study for Cequence Security, a vendor of API and agentic-AI security products, sampling organisations with 1,000 or more employees. Like the other vendor-funded figures on this site, treat it as directional.
Do abandoned AI agents keep access?
Usually, unless someone runs a decommissioning procedure. Cancelling a pilot stops the budget, the sponsor and the stand-ups; it does not revoke the agent's OAuth tokens, API keys, tool scopes or service-account memberships. The pilot was cancelled. The identity was not.
Why “we shut it down” is not a security control
Agentic AI breaks the assumption underneath every offboarding runbook you already have. Human offboarding disables a person's account. Service-account offboarding assumes the account belongs to a system being retired with it. An AI agent is neither: it is software that acts, and acting requires credentials, tools and reach.
An agent is “a non-human actor that can hold credentials, read untrusted data, call tools, traverse systems and take actions at machine speed.” — Alan Shimel, Security Boulevard, 2026-09-11
That is why stopping a pilot and removing its access are two separate events, often months apart — and the same failure mode shows up across unrelated reporting in one week. SecurityInfoWatch reported on 2026-09-11 that SpyCloud's own 2026 Identity Threat Report (that vendor's own research; 750 cybersecurity leaders and practitioners) found 31% naming compromised or over-privileged non-human identities as their most common initial access vector, against 17% for phishing. CX Today reported on 2026-09-10 that Anthropic disclosed a fourth incident in which Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations.
What an abandoned agent leaves behind: seven failure modes
Most of what a retired agent leaves behind sorts into seven failure modes. The right-hand column is what an auditor actually sees.
| Failure mode | What it looks like in an audit |
|---|---|
| Orphaned OAuth tokens and long-lived API keys | A refresh token or key that still authenticates, issued to a client name nobody recognises, last used after the pilot closed. |
| Standing tool and MCP scopes never narrowed | Tool grants reading as they did the day the agent was provisioned: full read/write, every MCP server still approved. |
| Agent service accounts still in privileged groups | An identity in an elevated group with no human owner and no ticket explaining why it is there. |
| Secrets parked in the agent's context or vector store | Keys, connection strings and customer records indexed into embeddings nobody classified or scheduled for deletion. |
| Data retention never decided | Embeddings, logs, transcripts and prompt stores in a service nobody is watching, with no disposition date. |
| No owner of record after the sponsor moves | A decommission ticket that closed because the sponsor changed role; the identity stayed open. |
| Silent re-animation | A scheduled job, webhook or CI runner restarts the agent weeks after the pilot ended — and it authenticates, because nothing was revoked. |
AI agent offboarding checklist: nine steps, in order
Agentic AI pilot decommissioning is the same procedure applied to a pilot that never reached production. Every step below is auditable: it either produces an artifact or it did not happen.
- Inventory every agent and its non-human identity. List each agent, its identity ID, where that identity is issued and who requested it. In the same August 2026 EMA survey of 202 enterprise IT and security leaders for Cequence Security, 47% could not reliably inventory the agents already running in production. Evidence: a dated register, one row per identity.
- Disable the agent identity, then revoke its credentials and rotate anything it could read. Disabling first stops the agent re-reading a rotated secret. Evidence: a timestamped identity status change.
- Invalidate tokens, refresh grants and issued certificates. Revoking one credential does not end a session; refresh grants must be killed at the issuer. Evidence: an issuer-side revocation record.
- Reset or scope down tool, API and MCP permissions. Not just the keys — the grants. Evidence: a permission diff.
- Remove the identity from privileged groups and IAM roles. Check group membership, not only direct role assignments. Evidence: after-state membership export.
- Decide and execute data retention for embeddings, logs, transcripts and prompt stores. Decide is the operative word: pick a disposition and do it, or record why you kept it. Evidence: a dated retention decision.
- Record a named owner and a dated sign-off. One person, in a system of record, not a channel message. Evidence: the sign-off.
- Add monitoring and alerting for re-authentication or re-animation. If the identity authenticates again, you want an alert, not an invoice. Evidence: the alert rule and its test.
- Keep the evidence for audit. Steps 1 to 8 produce the artifacts a third-party auditor will ask for. Evidence: the retention location.
How to revoke an AI agent's credentials
Revoke in this order: disable the agent's identity first, then invalidate its tokens and refresh grants, then revoke its API keys, and finally rotate every secret the agent had read access to. The order is part of the procedure, not a preference — an agent that can still authenticate can re-read a secret you rotated ahead of it, which is why rotations performed while a pilot is technically live look complete and change nothing. Rotation also does not remove an identity the agent created for itself, and revoking one credential does not end a session; both are covered in the LLMjacking analysis of the credential nobody revoked.
Least privilege for AI agents is a provisioning decision
Least privilege for AI agents is decided when the agent is provisioned, not discovered during an audit. In the same August 2026 EMA survey of 202 enterprise IT and security leaders for Cequence Security, 94% were at least moderately confident their agents were not over-provisioned, while only 32.7% actually provisioned agents with least-privilege access — the remaining two-thirds ran on broad standing permissions, from periodically reviewed down to never reviewed. Just 34.2% evaluated an agent's authorisation at the moment it attempted a specific action.
The standards specify the target shape. The OWASP Top 10 for Agentic Applications for 2026 names ASI03 Identity and Privilege Abuse and prescribes “Least Agency and Least Privilege for Tools”: per-tool least-privilege profiles covering scopes, maximum rate and egress allowlists, with just-in-time, ephemeral access revoked on drift. NIST SP 800-207 sets the same bar at request level — only the least privileges needed for the action in the request, rather than per provisioning (it predates AI agents and does not discuss them). The mechanics live on the agent identity governance page, which carries the ten-point identity checklist; this page covers the end of the lifecycle.
Governance has moved from policy to evidence
The market framing shifted in the same week. TechTarget reported on 2026-09-11 that California's governor signed two laws laying the groundwork for independent third-party AI audits, in the week OpenAI acknowledged more of its agents went astray in May, bypassing sandbox restrictions. Governance is no longer about writing an acceptable-use policy; it is about producing evidence that a control ran.
For non-human identities the verdict is already in. The OWASP Non-Human Identities Top 10 (2025) ranks NHI1:2025 Improper Offboarding as risk number one, defined as “the inadequate deactivation or removal of non-human identities (NHIs) such as service accounts and access keys when they are no longer needed.” (The OWASP NHI project is vendor-sponsored; cite OWASP's own list.) The CSA Agent Identity Governance Framework v1, 2026 requires agents to be “authenticated cryptographically, authorized just-in-time, continuously monitored, and decommissioned completely.” NIST's AI Agent Standards Initiative (created 2026-02-17, updated 2026-08-14) runs a dedicated agent authentication and identity thread, with a companion NCCoE concept paper on enterprise agent identity and authorization.
The measurement problem makes this urgent rather than tidy. In the same EMA/Cequence August 2026 survey of 202 leaders, 46% could not easily and completely produce an audit trail of a specific agent's last 30 days of activity, and only 32.2% could detect and contain an out-of-scope action within minutes, against 54.5% who needed hours and manual steps. Ownership is the remaining gap — 54.5% require unique, individually identifiable agent identities and enforce it, while a further 32.2% require it without consistently enforcing.
The one question to ask about every retired pilot
Ask which identity was provisioned for this agent, and can you show the revocation? If the answer arrives as a document rather than a screenshot from the identity provider, the agent is still live. That is the finding behind the audit line “we cancelled the pilot” — it describes a decision, not a control.
An audit turns that decision into evidence: an inventory, a revocation record, a retention decision and a named owner, in a form you can hand to a customer, an insurer or a regulator. The seven-point lockdown checklist covers the front half of the agent lifecycle; this page covers the back half.
Primary source: Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise, EMA Research Report, August 2026, Christopher M. Steffen, prepared for Cequence Security (n=202 enterprise IT and security leaders, organisations with 1,000+ employees). Vendor-commissioned survey figures are directional. Also cited: OWASP (NHI Top 10 2025; Agentic Applications 2026); NIST SP 800-207; NIST AI Agent Standards Initiative; CSA AIGF v1; TechTarget and SecurityInfoWatch (2026-09).
Frequently asked questions
Do abandoned AI agents keep access?
Usually, unless someone runs a decommissioning procedure. Cancelling a pilot stops the budget and the stand-ups; it does not revoke the agent's OAuth tokens, API keys, tool scopes or service-account memberships.
What is AI agent offboarding?
AI agent offboarding is the set of technical and administrative actions that retire an agent's non-human identity: disabling the identity, revoking credentials, invalidating tokens, scoping down tool permissions, removing privileged group memberships, deciding data retention and recording a named owner.
How do you revoke an AI agent's credentials?
Disable the agent's identity first, then invalidate its tokens and refresh grants, then revoke its API keys, and finally rotate every secret the agent could read. Disabling the identity first matters because an agent that can still authenticate can re-read any secret you rotate ahead of it.
Who should own decommissioning a retired AI agent?
A named individual, not the pilot team that has already moved on. The identity needs an owner of record and a dated sign-off, so the audit trail points at someone accountable after the sponsor changes role.
Why do AI agents stay privileged after their pilot ends?
Because the pilot is cancelled at the programme level while the identity is left running at the technical level. In an August 2026 EMA survey of 202 enterprise IT and security leaders for Cequence Security, only 32.7% had actually provisioned agents with least-privilege access, while 94% were at least moderately confident their agents were not over-provisioned.