Offboarding has two triggers, a retired agent and a departing human owner, and the second is the one firms miss: an agent whose builder left keeps running on that person’s credentials and tribal knowledge until it breaks or an examiner asks who owns it.

OWASP ranks this first. Improper offboarding is NHI1 in the Non-Human Identities Top 10, ahead of every other machine-identity risk, and its three named scenarios are exactly the ones a citizen-agent estate produces: stale identities left by retired services, orphaned identities whose owner departed with no successor designated, and partially offboarded employees whose credentials were never revoked. The naming collision matters: OWASP’s “offboarding” is the identity’s, not the person’s, so a firm can run a flawless HR leaver process and still fail NHI1 completely.

The 2026 agentic mapping goes further: OWASP maps NHI1 forward to agentic supply-chain vulnerabilities and to tool misuse, not to access hygiene. An orphaned agent identity is a credentialed thing inside the perimeter that nobody is watching and nobody will notice changing behaviour, a supply-chain exposure of the firm’s own making.

The scale of the gap is measured, if imperfectly. In a 2024 CSA survey of 818 practitioners, 20% of organizations had a formal process for offboarding and revoking machine credentials. A follow-up fielded in late 2025 (n=383) found 78% with no documented policy for creating or removing AI identities at all, 51% naming unclear ownership as a top pain point, and only 14% with creation and removal fully automated and 27% still fully manual. Both were vendor-commissioned and self-reported, with the second sample small, so treat them as order-of-magnitude rather than precise, though the direction they point in is undisputed.

The checklist

Agent retirement.

1. Revoke every credential the agent holds, not the ones the registry says it holds. Terminating the process is not revocation; see kill switches and revocation for why the token outlives the kill.
2. De-provision the identity itself. OWASP’s guidance is per-instance distinct identities, secrets held in a manager, keys rotated on schedule, clear ownership, and de-provisioning at retirement specifically to prevent orphaned exploitable identities.
3. Remove it from discovery: the tool catalogue, the MCP registry, the directory other agents resolve against. An agent other agents can still find is still in the graph.
4. Archive logs and memory per the firm’s retention rules before anything is deleted, then confirm that what the agent wrote elsewhere, in vector stores, shared memory and downstream tables, is accounted for. See memory and context poisoning.
5. Mark the registry row with a disposition and a date, and record who decided. Retirement is a governance decision with an owner. McKinsey names life-cycle management as the thing that ensures outdated and redundant agents actually go away.

Owner departure.

6. Hook the HR leaver process to the registry. On notice, query everything the departing person owns and force a disposition per row: reassign, retire, or rebuild. Cheap version: one question added to the existing leaver checklist. Thorough version: account deactivation blocks until every owned agent has a disposition recorded.
7. Designate the backup owner at registration, not at departure. This is Davenport and Barkin’s recommendation for citizen-built applications, and no independent source shows anyone doing it. Take it as a cheap idea from a book, not as established practice.
8. For anything business-critical, write the manual-redundancy procedure. WEF lists this alongside decommissioning as a baseline governance mechanism: plan for humans to take the work back. If nobody can, the honest disposition is “rebuild,” not “reassign.”

Decline the HR metaphor while keeping the mechanism. Several sources frame all of this as onboarding, performance management and retirement for a nonhuman workforce. The lifecycle stage is right and the vocabulary is expensive. In a randomized experiment with more than 1,200 managers, framing an AI as an employee led managers to identify 18% fewer errors, dropped individual accountability for errors by nine percentage points, and raised accountability attributed to the AI by eight. Offboarding depends on a human being accountable for a disposition. Call it asset retirement and identity de-provisioning. (BCG is on both sides of this: its 2025 survey work uses the HR analogy, its 2026 experimental work argues against it; prefer the experiment.)

How you’d know it’s working

Zero registry rows with a departed owner, checked quarterly. Every orphan found is a process failure with a date attached, and the date identifies which control leaked.

Time from exposure to revocation. In the late-2025 survey, about a quarter of firms took more than 24 hours to rotate or revoke credentials after exposure. That is a benchmark to beat rather than to match.

Share of identity creation and removal that is automated. 14% fully automated is the reported baseline. Where a firm’s is manual, a reminder will not fix the offboarding failure, because it was never a discipline problem.

A revocation drill on a real retired agent. Pick one retired last quarter and try to use its credentials. This is the only item here that produces evidence rather than an assertion.

What this doesn’t solve

This process handles known agents with known owners. The agent a leaver built on personal credentials in a personal account was never in the registry, and nothing on this page will find it. That is shadow agents, a discovery problem rather than a lifecycle one.

Revocation is also not erasure. What the agent already wrote into shared memory, what it already sent, and the decisions other systems already made on its output all survive its retirement intact.

And offboarding cannot fix an agent nobody understood while its owner was present. The succession gap predates agents by years: interviewed low-code experts describe having no mechanism at all to maintain an independently built application once its builder leaves, and HBR posed the same question in 2023 (a department comes to depend on a citizen-built app, the builder takes another job) and reported that few organizations had begun to consider it. Agents make it worse, because an agent keeps acting after the departure rather than merely sitting there. Documentation standards at build time are the actual fix, and they belong to citizen developer roles.

One number in circulation is worth refusing: OWASP’s NHI1 page attributes “32% of NHI-related security incidents were caused by orphaned identities” to a CSA report, and that figure could not be located in either CSA survey. Don’t repeat it.

See also

• Quality debt and orphaned apps — the classic citizen-dev failure this process prevents.
• Kill switches and revocation — revocation mechanics for the retirement step.
• Identity and access for agents — why agents on personal credentials make owner departure dangerous.
• Registry review cadence — the recurring check that catches the orphans this process misses.
• Shadow agents — the unregistered population outside this process’s reach.
• Citizen developer roles — the owner role whose lifecycle this process closes.