iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If an AI agent has acted without your permission, stop its current run, disable the identity or credentials it uses, and revoke access in every connected service—not just in the agent’s settings. Then check for still-valid tokens and application sessions, review logs, secure the human account that authorized it if compromise is possible, and verify that access is denied before restoring any automation.
Turning off an agent does not necessarily cancel credentials it has already received or sessions that connected applications continue to honor. The steps below provide a response sequence you can adapt to your agent platform and identity provider. Interface labels and token behavior vary by provider; the Microsoft Entra example is specific to that platform.
What to do first after an AI agent acts without permission
- Stop the active run. Use the orchestrator or agent service to stop execution. Block its tools, plugins, integrations, and high-impact actions while you assess what it could reach.
- Disable or isolate the identity it used. Determine whether access came from a dedicated workload identity, service principal, shared API key or secret, or a human user’s delegated (“on behalf of”) access. Disable or block the relevant identity where supported. If the identity is shared, identify every workload or person that depends on it before rotating the credential, while prioritizing containment.
- Identify every authorization route and connected service. List the agent’s credentials, OAuth consents and scopes, application-role assignments, refresh tokens, and downstream apps. Include integrations that may have been configured outside the agent interface.
- Keep a record of what you change. Note the time, agent identity, administrator making the change, affected credentials and services, and any incident or correlation IDs. Avoid deleting the agent or its configuration before recording details needed to investigate.
Microsoft warns that unclear agent identities and shared secrets make accountability and revocation harder. Its guidance recommends testing the full revocation path, including agent disablement, credential rotation, token invalidation, and removal of stale permissions.
Revoke access at every layer
Use the inventory to remove grants and credentials in the identity provider and in each affected application. Removing a connection in an agent dashboard may stop that interface from using it, but it does not establish that the underlying grant, key, token, or app session is invalid everywhere.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- OAuth consent and app roles: Remove unauthorized user or administrator consent, app assignments, and service-principal app-role assignments that should not remain.
- API keys and shared secrets: Rotate every key or secret the agent could access or that may have been exposed. Update legitimate dependent systems with the replacement credential, and retire the old one.
- Refresh tokens and provider sessions: Revoke refresh tokens and sign-in sessions using the provider’s supported controls. This can prevent new tokens or sessions from being issued, but does not always immediately invalidate access tokens already issued.
- Downstream application access: In each connected service, revoke app-specific grants or sessions when available. Check whether the application has its own cookie or session controls.
For illicit Microsoft Entra consent, Microsoft’s documented remediation includes removing an app assignment, revoking the OAuth permission grant, and removing a service-principal app-role assignment. The exact controls differ in other identity providers; use the provider’s current incident guidance rather than assuming Entra steps apply elsewhere.
Understand what each revocation step does—and does not do
These actions address different access paths. The effect depends on the provider, credential type, and whether a downstream service checks authorization again.
| Action | What it is intended to block | What may remain usable | Scope to check |
|---|---|---|---|
| Stop the run or disable the agent in its platform | Further activity through that run or agent interface | Credentials already issued, separately running processes, or access through another client may persist | Agent platform and any identity or integration it uses |
| Remove an OAuth grant or app-role assignment | Authorization represented by that grant, including future token requests that depend on it | Already issued access tokens may remain valid until expiry; app-managed sessions may need separate revocation | Identity provider and affected applications |
| Rotate an API key or secret | Use of the old credential after the service accepts the rotation or deactivation | Other credentials, existing sessions, or copies of the new secret placed in an insecure location | Every service where that key or secret was configured |
| Revoke provider sign-in sessions | Sessions the provider’s control covers and, depending on the provider, future refresh activity | Application-issued cookies or tokens the application continues to honor | Human account or agent identity, plus downstream apps with independent sessions |
| Revoke a session in a downstream application | The session managed by that application | Other app sessions, identity-provider grants, or credentials remain unless revoked separately | The specific application and its other authorization routes |
For Microsoft Entra, access tokens have a one-hour default lifetime according to Microsoft’s emergency-revocation documentation. That is an Entra-specific default, not a universal token lifetime. Microsoft says applications may continue honoring issued tokens until they expire, and an application-issued session token is controlled by the application rather than directly revocable by Entra. Microsoft’s consent-phishing guidance also distinguishes disabling an OAuth app—which blocks new token and refresh-token requests—from invalidating access tokens already issued. Ask each affected application how it handles existing tokens and sessions, and verify the result in that application’s logs or with a safe test account.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check whether the human account also needs securing
Agent access and human-account compromise are separate issues. If the person who authorized the agent may have been phished, had credentials stolen, or otherwise lost control of their account, contain that account as well as the agent identity. Follow the identity provider’s current emergency procedure and use an administrator role authorized to make the change.
For Microsoft Entra, Microsoft’s documented emergency path for a human user is to disable the account and select Revoke sessions. The documented Graph PowerShell route disables the user and calls Revoke-MgUserSignInSession. In hybrid Active Directory environments, Microsoft also describes disabling the account and resetting its password. These steps are Entra-specific; account-provider controls and effects vary.
Investigate what the agent could access and what it did
Review identity-provider audit and sign-in logs, app permissions and consent, the orchestrator’s run records, and activity logs in every downstream service. A chat transcript alone may not record tool calls or actions performed by connected applications.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For each relevant event, record what is available from the logs:
Recommended Free Tools
- Agent identity and whether it acted as itself or through a delegated human account
- Effective role, permission scope, and tool or integration used
- Action and affected resource, such as a file, mailbox, or configuration
- Timestamp, correlation ID, and user context
Correlating those details across the orchestrator, identity provider, and downstream service can help distinguish what the agent attempted from what a service actually accepted. Preserve relevant logs and records according to your organization’s incident process before routine retention or cleanup removes them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recover changes and verify containment before restoring automation
Review what was read, sent, changed, exported, or deleted. For reversible changes, use the affected service’s normal recovery controls. Escalate possible sensitive-data exposure or irreversible changes through the organization’s incident process; there is no single cross-provider recovery sequence.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before enabling the agent again, confirm each applicable condition:
- The old key or secret no longer works.
- Unwanted OAuth grants, app assignments, and app-role assignments have been removed.
- Relevant provider sessions and downstream application sessions have ended where the service supports revocation.
- A safe verification, such as an approved test account or service log review, shows that the old access path is denied.
- Any permissions reissued to the agent are limited to the approved purpose and required resources.
If a downstream app still accepts access, treat containment as incomplete for that route and work with its administrator or provider before restoring the automation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make future agent access easier to contain
Design permissions and ownership so an incident does not depend on finding a shared credential or guessing which account the agent used.
- Give each production agent a dedicated identity with a named owner and approver.
- Document its purpose, approved data, tools, environment, and authorization routes.
- Review the combined permissions it receives across identities, roles, and connected services; deny unreviewed integrations by default.
- Require additional approval or safeguards for high-impact actions such as deletion, export, or privilege changes.
- Prefer time-limited or just-in-time access where available, and ensure downstream services recheck authorization.
- Test the kill switch, credential rotation, token invalidation, and downstream denial rather than assuming each control works.
NIST IR 8587, published September 15, 2026, gives implementation recommendations for protecting identity tokens, access tokens, and assertions from forgery, theft, and misuse. Its recommendations address lifecycle controls, key management, token verification, and continuous monitoring for SSO, federation, and API access. NIST NCCoE’s February 2026 agent-identity publication is a concept paper—not a final operational standard—and considers OAuth/OIDC, workload identity, and SCIM lifecycle management as relevant approaches.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
