Topic starter
07/06/2026 8:56 pm
TL;DR: Old or compromised sessions can remain valid after password resets, device loss, or offboarding, and WorkOS describes session revocation as the mechanism that invalidates them across devices, including AI agent sessions. The governance issue is that expiry alone does not close access cleanly; revocation does.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Session revocation explained: Protect your users, systems, and AI agents”.
Key questions
Q: What breaks when session revocation is missing from identity controls?
A: Without revocation, a valid session can continue to authenticate after the user resets a password, loses a device, or leaves the organisation.
Q: Why do stale sessions create more risk than a simple logout feature?
A: A simple logout usually clears the local device, while stale sessions can remain valid elsewhere.
Q: How can organisations tell whether session revocation is actually working?
A: Look for rejected reuse attempts on revoked session IDs, complete revocation coverage after lifecycle events, and audit logs that show who revoked what and when.
Practitioner guidance
- Implement backend session revocation Make the server mark sessions invalid before natural expiry, and reject revoked sessions on every authenticated request rather than only at login.
- Inventory all active sessions Expose every live session per identity, including device, browser, IP address, and last-updated metadata, so administrators can terminate the full set of access points.
- Link revocation to lifecycle events Automatically revoke sessions on password reset, SSO deactivation, offboarding, and role changes so access does not survive the identity event that should have ended it.
Bottom line: Session revocation closes the gap between authenticated state and current authorisation intent, which is why it matters after password resets, offboarding, and device loss.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 8:41 am
Session expiry is not an access governance control: expiry defines how long a session may live, but revocation defines whether it should still be trusted. The distinction matters because authenticated state can outlive user intent, especially when the same identity is active on multiple devices or in delegated AI agent sessions. Practitioners should treat revocation as the control that closes the authority window, not as a convenience feature.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to the State of Secrets Sprawl 2026.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do when an AI agent's declared intent changes during a session?
A: They should treat the intent change as an indicator, not an authorization trigger. If the agent can change goals after reading content, then access must be bound to the original task scope and revoked when that scope ends. The safe decision is based on the bounded work unit, not the story the agent tells about itself.
👉 Read our full editorial: Session revocation and sign-out everywhere for users and AI agents
This post was modified 4 days ago by NHI Mgmt Group