Why revocation is harder than it sounds
When an employee leaves, most organisations have a routine: disable the account, recover the laptop, remove group memberships. AI access rarely fits that routine. Access may have been granted through an OAuth consent in Microsoft 365, an API key pasted into a tool’s settings, a personal access token for a code repository, or a connector configured on someone’s own computer. Each is a separate key, and each has to be found.
Step 1: find every grant
Build an inventory of where AI holds access:
- OAuth consents. In Microsoft Entra ID or Google Workspace, review enterprise applications or third-party app access. Look for AI tools and connectors, and note whether they have delegated or application permissions.
- API keys and tokens. Accounting systems, CRMs, databases and code platforms often use keys or tokens. Check who issued them and to what.
- Local configuration. MCP servers and connectors configured on individual machines may hold credentials in local files.
- Guest and external access. Clients, contractors or partners whose AI you have allowed in.
If you cannot produce this list quickly, that is the first thing to fix.
Step 2: revoke at the source
Revoke where the credential is honoured, not only where it is used:
- Remove the consent or grant in the identity provider or the business system.
- Revoke refresh tokens where the system allows it, so existing sessions cannot renew.
- Rotate shared secrets. If a key was shared between several tools or people, replace it. Assume it has been copied.
- Disable the agent’s identity, if it has one.
- Remove local configurations on devices you manage.
Check your provider’s current settings; the exact steps and how quickly revocation takes effect vary between systems.
Step 3: confirm and record
- Test that the AI can no longer reach the system.
- Review the audit trail for the period before revocation. What did the AI retrieve or change?
- Record what was revoked, when and why.
What revocation cannot do
Revocation stops future access. It cannot recall information an AI has already retrieved, or information a guest has already seen. If data reached an AI provider, its handling depends on that provider’s terms and your settings. This is why limiting access in the first place matters more than being able to remove it afterwards.
Design for revocation
- Keep credentials in as few places as possible.
- Give each agent its own identity so it can be switched off individually.
- Prefer short-lived access and automatic expiry for guests and one-off tasks.
- Make “revoke” something an administrator can do in one place.
How Kroy approaches it
Because AI tools connect to Kroy rather than holding credentials to your systems, there is one place to revoke. You can disconnect an agent, withdraw a delegation, end a guest’s access or disable a Skill, and the change applies to the next request. Guest access can also expire automatically. Kroy records the revocation along with everything that happened before it.