Topic starter
06/07/2026 9:36 am
TL;DR: Offboarding often stops at human accounts while OAuth tokens, API keys, SSH keys, service accounts, and AI agent identities remain active in cloud, CI/CD, and SaaS environments, leaving a hidden attack surface, according to Token Security. The control failure is not deprovisioning itself but the broken assumption that employee exit cleanly ends machine access.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Offboarded Employees and the Non-Human Identities They Leave Behind [The Complete Guide]”.
Key questions
Q: What breaks when offboarding only covers human accounts and not NHIs?
A: Human-only offboarding leaves behind active machine access through tokens, keys, service accounts and agent identities.
Q: When should organisations prioritise NHI revocation over employee account closure?
A: They should do both together, but NHI revocation must be treated as equal priority because closing the human account does not remove embedded secrets or delegated automations.
Q: What are the signs that offboarding has missed machine identities?
A: Common signs include long-lived tokens in repositories, service accounts with no current owner, duplicated keys in pipelines, and automations that still run after the employee leaves.
Practitioner guidance
- Map employee-owned NHIs before departure Inventory every token, API key, SSH key, service account and AI agent linked to the employee across cloud, CI/CD, SaaS and collaboration tools before the exit date.
- Transfer ownership explicitly Assign each surviving NHI to a named team or individual, and record the transfer in the offboarding workflow so revocation and review have a current owner.
- Revoke and rotate machine credentials immediately Remove access for all employee-created secrets, including credentials embedded in pipelines, repositories and chat tools, then rotate any shared or duplicated values.
Bottom line: The core problem is not employee departure itself, but the machine identities that remain active after the human account is closed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:50 am
Offboarding is now an identity lifecycle problem, not a human deprovisioning task. The article shows that employee exit does not end access if the employee created tokens, keys, service accounts or agents that continue operating elsewhere. That breaks the old HR-led assumption that disabling the human account closes the security event. Practitioners should treat offboarding as a multi-identity lifecycle process spanning human and non-human access.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams offboard AI agents when projects end?
A: They should retire the identity, revoke keys and tokens, remove any control-plane registration, and verify that no downstream workflow still trusts the agent. Offboarding has to be a formal governance event, not an informal note in a project tracker, because lingering access is how ghost agents remain active.
👉 Read our full editorial: Offboarded employees leave behind hidden non-human identity risk