- ›
Revoking an AI agent means cutting off its ability to act— immediately, without redeploying or rotating your workspace key. - ›On Naïve, agentProfile.revoke() suspends the profile; the governance gateway denies all further tool calls.
- ›
Revoke is absolute— applies mid-action, cascades to sub-agents, releases runtime slots. - ›For narrower scope, sessions.revoke() kills one MCP connection without suspending the whole profile.
- ›Surfaces: SDK, REST, CLI, and MCP tools.
- ›Wire revoke into offboarding, incident response, and customer churn flows before you need it under pressure.
Revoking an AI agent's access means every further action is denied — immediately, without redeploying your app or rotating your workspace API key. On Naïve, revoke is a first-class operation on the governed agent profile: suspend the profile and the governance gateway blocks all subsequent tool calls.
This guide covers agent-profile revoke (full stop) and session revoke (single connection). For spend caps and approval before things go wrong, see spend caps, approvals & revocation for AI agents.
When do you revoke?
- Customer offboarding — their agent must stop now, not at end of billing period.
- Suspected compromise — prompt injection, anomalous tool pattern, unknown runtime.
- Runaway loop — agent retrying a failing call faster than caps can help.
- Policy violation — customer tier changed; agent should lose capabilities immediately.
Revoke is the off switch. Approval is the pause button; caps are the volume knob.
Step 1 — Identify what to revoke
| Target | Scope | Use when |
|---|---|---|
| Agent profile | Entire bundle — identity, money, comms, runtime | Agent itself is untrusted |
| MCP session | One MCP connection | One runtime leaked; profile stays active |
Most incident responses use agent profile revoke. Session revoke is for surgical cuts — see delegated MCP sessions.
Step 2 — Revoke the agent profile (SDK)
const op = await naive.forUser(tenant.id).provision("support", { idempotencyKey: `op:${tenant.id}` });
// … later, when you need to stop everything:
await op.revoke();Revoke is absolute. The governance gateway denies all further tool calls, releases the runtime slot, rotates credentials, and cascades to sub-agents. Revoking a parent profile kills the whole multi-agent system.
Step 3 — Revoke via REST / CLI / MCP
REST:
curl -X POST "https://api.usenaive.ai/v1/agent-profiles/{id}/revoke" \
-H "Authorization: Bearer nv_sk_your_key"CLI:
naive agent profiles revoke <profile-id>MCP tool: naive_revoke_agent_profile — useful when your ops agent itself runs over MCP.
See agent profiles docs for the full surface table.
Step 4 — Revoke a session (optional, narrower)
await naive.forUser(alice.id).sessions.revoke(sessionId);The MCP client gets rejected on the next call. Other sessions and the agent profile keep working.
Step 5 — Verify access is cut
Attempt a tool call on the revoked profile — expect 403 forbidden from the gateway, not a provider error. List pending approvals; new actions should not start. If hosted runtime was running, confirm the slot released.
How do you know it worked?
- Tool call after revoke → structured denial, logged.
- MCP session after
sessions.revoke→ connection rejected. - Workspace key and other tenants → unaffected.
- Re-provision requires a new profile (revoked profiles don't silently reactivate).
Wire revoke before you need it
The mistake teams make is treating revoke as an incident-only script. Put it in:
- Offboarding webhooks — customer deleted → revoke their agent profile.
- Admin UI — one button, not a runbook with twelve steps.
- Automated guardrails — optional: revoke when hard budget exceeded N times in M minutes.
Revoke under pressure is only reliable if you've practiced the one-liner when calm.
Where to go next
That's instant revoke: profile for full stop, session for one connection. The architecture is in the governance gateway docs; the lifecycle context is the governed agent profile.
How do you revoke an AI agent's access instantly?+
What happens after you revoke an agent profile?+
Can you revoke just one session without killing the agent?+
Do you need to rotate API keys to revoke an agent?+
When should you revoke vs pause vs cap?+
Building the agent-native backend.
A governed agent profile is an AI agent with identity, spend limits, approvals, audit, and instant revoke — enforced on every action. Here's the full lifecycle.
Per-user MCP sessions give AI agents delegated, revocable access — short-lived, kit-scoped credentials instead of your workspace key. Here's the pattern.
Spend caps, human approvals, and instant revoke for AI agents must be enforced server-side — Naïve's governance gateway applies all three on every call.
Human-in-the-loop approvals that freeze sensitive actions until you say yes, a per-user audit trail of everything an agent did, short-lived scoped MCP sessions, and unified async job tracking — the controls that make an autonomous fleet safe to run.