An agent-offboarding test should not stop at a successful admin response. It should establish which future requests are refused, whether new credentials can still be issued and what happens to work already accepted downstream.
This is a proposed test design for a fictional document-collection agent, Intake Worker. It is not an implementation or a report of measured revocation performance. The assumptions are an identity registry, an OAuth-backed connector, a resource that may cache token state and a separate job queue. Replace those assumptions with your actual stack before using the test plan.
Model the objects separately
The registry identity is not the credential. The credential is not the grant. The grant is not the queue. A completed external effect is not any of them. Keep separate identifiers and state transitions so that a change to one can be reconciled against the others.
For Intake Worker, the identity record links an accountable owner and approved purpose to a workload. The connector has a way to obtain access. The resource applies its own access decision. A scheduler creates jobs, and an external service may accept work that outlives the originating process.
Test inventory: identity record, issuance path, grants, resource acceptance, scheduler or queue and completed business effects.
NIST's agent identity design-tenets blog, dated 27 October 2026, proposes distinct agent lifecycles and dynamic revocable authority. Treat it as current design guidance under discussion, not a normative protocol or certification. The engineering task here is to make those lifecycle boundaries observable.
Define a cutoff and an acceptance contract
Use a test environment with harmless operations and isolated credentials. Record the retirement decision time, the control-plane acknowledgement and observations at each resource. Do not assume clocks are perfectly aligned. Preserve the clock source or uncertainty needed to interpret intervals, especially across services operated by different teams.
The acceptance contract should state whether new work is blocked, whether pending work is cancelled or drained and which operations must stop within the chosen target. That target is a requirement justified by the workflow's risk. This article supplies no universal number of seconds and no observed service-level result.
A simple lifecycle state model might distinguish active, transfer-pending, suspended, retiring and retired. Those names are an example, not a standard. What matters is that the transitions have defined authority effects. Retiring can honestly mean some work is still being reconciled. Retired should not be a convenient label for an unresolved queue.
Test revocation and issuance independently
OAuth token revocation, RFC 7009, provides a token invalidation endpoint and describes related-token behaviour and propagation considerations. Its successful response can also cover an invalid token. Therefore, a response from that endpoint is evidence about the revocation request, not a complete end-to-end test of every resource.
Keep a pre-retirement test credential in the isolated harness and attempt a harmless protected operation after the cutoff. Record acceptance or rejection at each relevant endpoint. Then attempt fresh credential acquisition using the retiring workload's normal path. Both tests matter. Stopping existing access while leaving issuance available may simply move the workload onto a new credential.
As one provider-specific illustration, AWS documents role-session revocation using a deny policy scoped to sessions issued before a cutoff. Later sessions fall outside that restriction. Do not generalise the mechanism to other platforms; use it as a reminder to inspect both existing sessions and new assumption or issuance paths.
Exercise stale state deliberately
If the resource uses OAuth introspection, include a case in which it cached an active response immediately before retirement. The standard discusses the security and performance trade-off of caching. Your test should measure the behaviour of the configured resource, not merely confirm that the authorisation server now returns inactive.
If access tokens are validated locally, document the actual mechanism by which revocation becomes effective: expiry, an additional policy check, a deny mechanism or another supported design. Signature validity alone does not communicate a later administrative decision. Test every relevant path rather than infer identical behaviour from a shared token format.
Observation timeline: decision, issuance stop, invalidation acknowledgement, resource rejection and completion of work reconciliation.
Introduce a controlled failure in the test environment. For example, make the token-state service unavailable and observe whether the protected operation fails closed, uses a cached answer or takes another documented path. The correct choice depends on the operation and agreed availability policy. The unacceptable result is discovering an undocumented fallback during retirement.
Also check alternate connectors and direct routes. A denial at the gateway does not prove denial at a separately reachable resource. A test report should identify which route was exercised, the workload identity, the policy version and the outcome without retaining raw secrets.
Follow jobs beyond the original process
Stop Intake Worker's scheduler and identify jobs that were already queued. Verify the chosen disposition: cancellation, quarantine for review or explicitly authorised completion. Then inspect work already accepted by downstream systems. Process termination does not establish downstream cancellation unless the integration actually supports and confirms it.
Completed business effects require separate accounting. A sent request for documents cannot be removed from a recipient's memory by revoking OAuth access. If the organisation needs a correction, assign a compensating action to an appropriately authorised actor. Record the link between the original effect and that action; do not overwrite the original evidence.
Proposed acceptance matrix: old access, fresh issuance, stale caches, pending jobs, downstream work and completed effects each require their own evidence.
For ownership transfer, preserve the previous owner's effective interval and record the incoming owner's acceptance. Reassess grants and operational duties instead of copying a human's permissions into the workload. A transfer test should establish that the intended operations remain available and removed operations are denied under the new arrangement.
Define what the test report cannot prove
A finite set of observed rejections does not prove that no unknown credential or route exists. Coverage depends on the inventory. State which integrations were included, which were unavailable and which assumptions remain unverified. That limitation should drive the next inventory improvement rather than be hidden in a generic pass rate.
The agent audit-trail guide provides a companion approach to evidence. The incident regression workflow helps turn any discovered gap into a repeatable test. This lifecycle exercise is intentionally broader than checkpoint revalidation: it asks whether the workload can continue obtaining or exercising authority at all.
Retirement is a distributed state transition with business consequences. Treat it as something to test, not something the settings page has already proved for you.
Top comments (0)