AI Agent Offboarding Checklist: Six Phases and the Evidence Each One Must Produce
AI agent offboarding is the process of retiring an agent's non-human identity: disabling the identity, revoking its credentials, invalidating its tokens and refresh grants, scoping down its tools, closing its network egress, deciding its data's fate, and recording a named owner. Skip it and a production credential outlives the agent, with nobody accountable.
Do these seven, in order:
- Revoke the identity and its credentials, disabling it first.
- Invalidate tokens, refresh grants and certificates.
- Rotate every secret the agent could read.
- Scope down tool, API and MCP grants.
- Decide retention for embeddings, logs and prompt stores.
- Record a named owner of record.
- Alert on any re-animation attempt.
In an August 2026 Enterprise Management Associates (EMA) survey of 202 enterprise IT and security leaders for Cequence Security, a vendor, 30% of the agentic AI pilots that never reached production had been paused indefinitely, discontinued or abandoned, and the report states most were not cleaned up, leaving their provisioned credentials and production access in place. That 30% covers non-producing pilots only; the cleanup finding is directional, not a measured share.
The offboarding checklist: six phases
1. Discover
- Inventory every agent that ever had access.
- Inventory the non-human identities behind them: service accounts, API keys, OAuth clients, self-created identities.
- Name a human owner for each identity.
Minimum acceptable evidence: a dated register: each agent, identity ID, issuer, named owner.
2. Disable
- Revoke the agent's credentials, disabling the identity first.
- Invalidate tokens, refresh grants and certificates at the issuer.
- Rotate every secret the agent could read.
Minimum acceptable evidence: an issuer-side revocation record and a timestamped identity status change.
3. Narrow
- Reset tool, API and MCP scopes to nothing it still needs.
- Remove it from privileged groups and IAM roles — membership, not direct assignments.
- Close the network egress the agent used.
Minimum acceptable evidence: a permission diff and an after-state membership export.
4. Dispose
- Decide retention for embeddings, logs, transcripts and prompt stores.
- Delete or archive them, with evidence either way.
Minimum acceptable evidence: a dated retention decision naming what went, what stayed and why.
5. Document
- Record the owner of record by name.
- A dated sign-off in a system of record, not a channel message.
- The evidence pack, retained for audit.
Minimum acceptable evidence: a signed-off pack an auditor can reach.
6. Monitor
- Re-authentication by the retired identity.
- Scheduled jobs, webhooks or CI runners that could re-animate it.
Minimum acceptable evidence: a tested alert rule and its last test date.
What the standards already require
Offboarding is not a house rule. The OWASP Non-Human Identities Top 10 (2025) ranks NHI1:2025 Improper Offboarding as risk number one: “the inadequate deactivation or removal of non-human identities (NHIs) such as service accounts and access keys when they are no longer needed.”
The OWASP Top 10 for Agentic Applications 2026 names ASI03 Identity and Privilege Abuse with per-tool least-privilege profiles; the CSA Agent Identity Governance Framework v1, 2026 requires agents to be decommissioned completely; NIST SP 800-207 sets least privilege per request, not per provisioning.
Two habits make it stick: give the agent its own scoped identity rather than a shared human one (ten-point agent identity governance checklist), and treat revocation as a runbook, not a one-off (the credential nobody revoked; front half of the lifecycle: seven-point lockdown checklist). The full procedure: the pillar guide to agentic AI pilot decommissioning.
Source: EMA Research Report, August 2026, prepared for Cequence Security; vendor-commissioned, so directional. OWASP's NHI project is vendor-sponsored.
Frequently asked questions
Does a retired AI agent keep its access?
Usually, until someone runs the procedure above. Cancelling a pilot stops the budget and the stand-ups; it does not revoke its tokens, API keys or tool scopes.
What must be revoked when an agent is retired?
Its identity, credentials, tokens, refresh grants and tool, API and MCP scopes — then rotate every secret it could read.
How long do agent credentials live?
As long as nobody revokes them. A key or refresh grant issued for a pilot does not expire with it, so an abandoned agent can still authenticate.
Who owns AI agent offboarding?
A named individual in the identity system, not the pilot team that has moved on. Without an owner of record it closes quietly when the sponsor changes role.
How do you stop a retired agent being re-animated?
Alert on any re-authentication by its identity, and cover the schedulers that could restart it: cron jobs, webhooks, CI runners, vendor-side triggers.