What happens when an AI agent keeps its grants after the human owner is disabled?

The grant can outlive the account, which leaves the agent operating with effective authority after the person is removed. That creates an orphaned agent pattern where disabling the human does not revoke the machine. If grant revocation is not tied to account suspension, data can still leave through the surviving authorization path.

Why the grant can outlive the human account

When an AI agent is authorized through a grant, token, or delegated permission, that authority may be tied to the agent’s authorization record rather than the human account alone. If the human owner is disabled but the grant is not revoked, the agent can still act until the authorization itself expires, is rotated, or is explicitly removed. That is the core orphaned-agent failure mode.

This is especially important in delegated and on-behalf-of patterns, where the agent’s effective power is separated from the person who originally approved it. The right question is not “is the human disabled?” but “what live authorizations still exist, and who can still exercise them?”

In practice, the surviving path is often a token, refresh token, OAuth grant, API key, or other persistent credential that was never coupled tightly enough to account suspension. Ultimate Guide to NHIs — What are Non-Human Identities is useful background for the wider identity model, while RFC 8693: OAuth 2.0 Token Exchange explains the delegation pattern that can create this gap.

What changes operationally when revocation is not coupled to suspension

The operational issue is not just access persistence. It is loss of control over lifecycle state. A disabled person may no longer be able to log in, but the agent can still reach data, call APIs, trigger workflows, or move information if the grant remains valid. In other words, the account is gone, but the authority is still alive.

That creates a mismatch between HR or admin action and access reality. If offboarding only disables the human principal, teams can wrongly assume the environment is safe while machine-mediated access continues. This is why agent grants need explicit ownership, revocation logic, and expiry behaviour independent of the human account.

Top 10 NHI Issues covers the lifecycle and governance patterns behind orphaned and stale access, and Guide to NHI Rotation Challenges is relevant when the surviving authority depends on long-lived secrets or refreshable credentials.

The practical consequence is that the agent may continue operating with effective authority after the original owner is removed, which can make audits, incident response, and access reviews misleading unless the grant itself is treated as a first-class object.

Why this becomes a governance problem, not just an auth problem

Once an agent can outlive its owner, the issue becomes governance as much as authentication. You need a clear answer to who owns the grant, what event revokes it, how quickly revocation propagates, and whether the agent can reconstitute access from a surviving credential. If those answers are unclear, the environment has an orphaned authorization path.

That is also why broad identity controls matter here: the risk is not simply “bad login hygiene,” it is unmanaged authority. If the grant can still read data or call privileged tools, disabling the human does not close the exposure. The control objective is to remove the agent’s authority at the same time as, or before, the human account is suspended.

RFC 7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants is relevant when signed assertions are used to establish agent access, and The 2024 Non-Human Identity Security Report provides broader practitioner context on excessive permissions and lifecycle management.

Risk and Threat Considerations

Orphaned grants create a quiet persistence path: the human is disabled, but the machine authority remains usable until someone explicitly revokes it. That can lead to continued data access, API calls, and workflow execution after an apparently successful offboarding event.

Failure mechanism: Lifecycle controls are split, so disabling the user account does not revoke the agent’s grant, token, or refresh capability. Attackers or insiders who inherit the surviving authorization can continue operating under the old authority.

Impact: Sensitive data can still leave the environment, privilege can remain active longer than intended, and incident response may miss the live access path because the human principal no longer exists.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Improper Offboarding	Disabled owners can leave agent grants active, creating orphaned non-human access.
	NHI-07 — Long-Lived Secrets	Surviving tokens or secrets let the agent keep operating after human disablement.
Recommendation — Revoke the agent’s grants when the owner is disabled so the non-human access path cannot survive. Shorten credential lifetime and invalidate surviving secrets at offboarding.
OWASP Agentic AI Top 10	ASI03 — Identity & Privilege Abuse	Persistent agent authority after human disablement is a privilege-boundary failure.
Recommendation — Bind agent authority to explicit revocation so surviving privileges cannot be reused.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Grant survival often depends on unmanaged tokens, refresh tokens, or keys.
	AC-2 — Account Management	Lifecycle control must remove related access paths when an account is disabled.
	AC-6 — Least Privilege	Orphaned grants preserve more authority than the disabled owner should keep.
Recommendation — Invalidate authenticators and refresh material when the owner is suspended. Tie account disablement to removal of dependent access paths and grants. Reduce retained agent privileges to the minimum and remove unused entitlements.
NIST SP 800-63	Digital Identity Guidelines	Lifecycle assurance matters when delegated access survives account disablement.
Recommendation — Use lifecycle-aware identity processes that revoke dependent grants at deprovisioning.

Practitioner Guidance

What to verify: Confirm that account suspension triggers grant revocation, token invalidation, and any downstream session or refresh-token cleanup. If the agent can still authenticate after the owner is disabled, the control is incomplete.

Decision rule: If a grant can reach production data or privileged tools, treat it as a live authority object with its own lifecycle. Do not rely on human disablement as a substitute for revocation.

Practitioner takeaway: The safe state is not “the user is disabled”, it is “no surviving grant can still act.” If that distinction is not enforced, the agent remains operationally alive even after the owner is gone.