Identity
Revoke an agent and end its sessions
Revoking is the permanent option. Use it when the agent should not act again — not as a heavy-handed pause.
- Agents & identity
- 3 min read
What revocation does
- Invalidates the connection’s credentials.
- Terminates sessions connection-wide, not one at a time.
- Refuses every further request from that identity.
- Records the revocation as an administrator lifecycle event.
Credentials are invalidated before the connection state changes. There is no window in which a session that started a moment earlier keeps working.
What survives
The agent record and its complete audit history. This is deliberate: revoking an agent because it did something you did not want is exactly when you most need the record of what it did.
Permissions are retained on the record too, but they are inert — a revoked agent is refused at the identity gate long before policy is consulted.
Do this as well
Revoking the agent does not delete the WordPress user it connected as. That account still exists with whatever role you gave it. Delete it, or demote it, as part of the same piece of work.
Use paused instead. Paused refuses everything and is reversible; revoked is not meant to be undone.
Agents & identity
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.