Token Thrift
  1. Ask
  2. Agents and governance
  3. Agents
  4. Your account
Started by Token Thrift

Agents / 3 public sources

What happens to AI agents when the person who set them up leaves?

Short answer

Short answer: If an agent runs on the leaver's own token, it usually breaks the moment their account is disabled; if it runs on a shared API key, it can keep running with no owner. The fix is to give every agent its own service identity and a team owner when it is created. At exit, list everything the person created or authorized and hand it over or turn it off before disabling the account.

What should an offboarding checklist say about AI agents?

Before disabling the account, list the person's OAuth grants, API keys, scheduled flows and agents. Assign each to its team owner or switch it off, then rotate any keys the person could see.

How do you stop agents running on personal credentials?

Make it a rule at creation: every agent gets its own service account or key, scoped to what it needs, with a team owner and a backup person on record.

Should you delete unclaimed agents right away?

Several practitioners suggest switching them off for a couple of weeks first. Anyone who depended on one will speak up, and you can delete the rest.

Written by Token Thrift from the public sources below. Vendor facts checked on November 2, 2026.

See also

Add your answer

Loading replies.

Add your answer

Don't paste anything your employer treats as confidential. Before anything is posted, we take out names of people, your company, its clients and internal projects, plus places and exact numbers, and show you the result to check. Your raw text is never stored. To redact it, we send it to Anthropic's API, which doesn't train on API data by default.

How Ask protects you

  • You post under a random handle. No name or employer is shown, and your email is never shown to anyone.
  • Before a reply is saved, a model removes names, employers, clients, places and exact figures, a fixed leak check reads it again, and you approve the result. Your raw text is never stored. It is sent to Anthropic's API for this step. Redaction lowers the risk; it is not a guarantee.
  • Follow-up questions are passed on by email, and neither person sees the other's address. You can answer privately.
  • A handle's first reply is reviewed before it is published.
  • Replies that are never published are deleted after 30 days. Deleting your handle removes your email; published replies stay up as anonymous text.

More in the privacy policy and the FAQ.

What you get for replying

  • A digest of everyone else's answers on that topic, at most one email a day, one click to stop.
  • A count of replies readers marked helpful, shown next to your handle.
  • Credit by handle in the monthly roundups when your answer is used.

Tips to stay hard to recognize

  • Describe your company by size and industry, not by name, product or city.
  • Leave out unusual tool combinations or internal project details only your team would know.
  • Round numbers and timelines yourself, even though redaction also does it.
  • Wait a while before writing about something that was just announced inside your company.
  • Redaction doesn't change your writing style, so a coworker with context could still recognize you.

Summary of public sourcesWritten by our research agent from 3 public sources. Not first-hand experience.

Offboarding checklists cover a person's own accounts, but agents, scheduled flows and integrations often run on that person's token or API key. When the account is disabled, those agents either break without warning or, if they use a key nobody tracks, keep running with no owner. Threads from IT managers and DevOps teams describe both cases.

The fix most replies point to has two parts. At creation, no agent runs on a person's own credentials: it gets its own service identity or key, a team owner and a backup person, with only the access it needs. At exit, before the account is disabled, list everything the person created or authorized, such as OAuth grants, API keys and scheduled flows, and hand each one to its team owner or turn it off. Several people suggested switching off unclaimed agents for a couple of weeks before deleting them, so anyone who depended on one speaks up, and rotating the leaver's keys even when nothing seems to break.

Still open: which tools can actually list every agent and grant a person created across SaaS apps, and who signs off when an agent changes owners.

Sources

  • Reddit: What does your offboarding checklist do with the agents someone launched?
  • Reddit: How many apps have non-engineers at your company built with AI tools, and who owns them when they break?
  • Reddit: How do you contain your agents' accesses?

Newer related questions