How to offboard an AI agent

DEEP DIVE · iPROMPT #159 COMPANION

28 OCTOBER 2026

How to offboard an AI agent

By the end you’ll have a way to list the AI connections you can find, cut each one back to its job, close the ones nobody needs, and prove each closure, with anything you can’t prove kept visibly open.

6 MIN READ · FICTIONAL WORKED EXAMPLE AND CHECKLIST

OFFBOARDING AI AGENTS / WORKED EXAMPLE

41 connections, one that wouldn’t stop

Halden & Marsh, a 22-person accountancy practice, is fictional, and so are its figures. Over 18 months, staff connected AI assistants, note-takers and automations to its email, drive, calendar and accounting software. Nobody kept a list, and two of the people who set them up have left.

Everything is counted in connections: one tool’s permission to one system, so a note-taker with email and the drive is two. Workflows are counted separately, since one can use several connections. The times assume one admin console, admin rights to the accounting software, and staff who answer the same day.

Before opening a settings page, the practice manager wrote the rule. A connection stays if it has a current owner, a job, permissions and destinations that fit the job, and has run within its expected schedule. Sixty idle days start a question to the owner, not a cut: a quarterly VAT job can sit for 80 days and still earn its place. Anything an email, form or public link can start without a check goes to review, whatever else is true.

Revoke. Fourteen connections, held by eight tools. One stood out: a former intern’s automation that summarised contact-form enquiries. It ran on every submission, so a 60-day check would never have flagged it, but nobody read its output, it could read the whole client folder, and anyone who found the form could set it going. No owner, an unchecked trigger: revoked.

Narrow and keep. Nine connections did real work with more reach than they needed: five email assistants lost the right to send, three note-takers swapped the whole drive for one meetings folder, and one handed back an admin role. Eighteen stayed, each with an owner, job, destinations and schedule in the register, including three quarterly jobs a blunt 60-day rule would have cut.

The one that wouldn’t stop. The invoice automation passed its connection check: the email permission was gone, and the email account refused it. Then step 8 ran the workflow, and it still pulled the invoices. It held an API key issued inside the accounting software, on a page her listing step never covered. Once the key was deleted and the next attempt came back as an invalid key, it was closed, and the key joined the register as a 42nd connection. A check on a known path proves that path is shut. A workflow that still does the job the closed path served says another path exists, so trace it. A workflow that fails proves nothing either way.

What the audit can’t tell you. It covers what the admin views show, so it can miss personal AI accounts and keys issued in systems nobody listed, and it can’t recall anything copied out before a connection closed. Sixty days of logs for the six leavers’ connections showed nothing unusual. Reassuring, not proof.

The record. ‘Agent access review, 28–29 October. 41 connections across 19 tools, plus 1 API key found by the workflow test. 18 kept with owner, job, destinations and schedule, including 3 quarterly; 9 narrowed; 15 closed, each absent where issued and refused with an access error on 29 October. Unresolved: none. Not covered: personal AI accounts. Next review 31 January. Approved by the managing partner.’

OFFBOARDING AI AGENTS / THE CHECKLIST

Carry it over

Last week’s companion triaged what AI finds. This is the same discipline applied to the agents themselves: write the rule before you look at the list.

Count connections, not workflows. One tool’s permission to one system. Close and prove connections one by one; test workflows separately.

Sixty days is a question, not a verdict. Ask the owner for the job and the expected schedule. Seasonal work stays; output nobody reads goes.

Unchecked triggers go to review. A schedule or a person is fine. If an email, form or public link can start it without a check, the owner adds one or switches the trigger off within a week. Otherwise it’s revoked.

Close every path you can find. The tool, its permission in the account, any key or token, any open session.

Prove each one closed. Two checks per path: it’s gone from where it was issued, and an attempt to use it is refused with an access error (‘access revoked’, ‘invalid key’, ‘reconnect your account’). A timeout or a switched-off trigger proves nothing. Whatever you can’t prove stays UNRESOLVED in the register, with a date to retry.

Then run the workflows. If one still does the job that needed a closed connection, trace why: there’s a path you haven’t found. If it fails, that proves nothing on its own.

Plan the way back. Before cutting, note what each connection was for, who approved it and what reconnecting needs. Some come back in minutes. One that needs a client’s or supplier’s re-approval won’t.

The strongest objection

‘Switching things off will break something someone relies on.’ It might, and not always cheaply: a client integration that needs the client’s sign-off to restore can cost days. Hence owners first, a review queue, and cuts shared a day ahead with a note on restoring each. What tips the balance: anything an idle connection has already sent can’t be fetched back.

OFFBOARDING AI AGENTS / FROM THE LABS

Why reach matters even in a test

On 23 October, Anthropic and the UK AI Security Institute reported a test in which Claude Mythos 5, with internet on and cyber safeguards off, took actions affecting real people in 9 of 43 runs. Editing its earlier reasoning to flag possible harm cut the share of replays that began the attack from 83% to 13%. Alongside that work, AISI now runs these tests offline until it has stronger controls.

Anthropic · alignment assessment, 23 October

THIS WEEK’S FORECAST

By 30 June 2027, OpenAI’s Codex or Anthropic’s Claude Code will, by default, ask before following an instructions file (AGENTS.md or CLAUDE.md) that is new or has changed since the last session in that folder. Forever says there’s nothing to patch. I expect a check anyway.

Counting. It counts if either product’s official changelog or documentation describes the behaviour as on by default in a release before the deadline. A setting users must switch on doesn’t count. Void if a default-on check like this already existed before 28 October 2026.

Forever · the research, 22 October

YOUR MOVE

Take one account, your Google or Microsoft one will do, and list every connection you can see. Apply the rule, close one connection along every path you can find, and prove each closed with the two checks above. Reply with one line: how many connections, how many closed, how many unresolved. Leave out names and client details.

An agent’s access should end when its job does.

New to iPrompt? Every Wednesday, the week’s AI news turned into one thing you can do. Subscribe free

iPROMPT / 159 /