AI tool access revocation
When someone leaves — an employee, a contractor, an intern — your standard offboarding flow revokes their email and SSO login, but AI tools open access paths that the standard flow rarely covers. A personal API key hard-coded into a script keeps working after the login is gone. A shared ChatGPT account stays logged in. A fine-tuned model trained on company data sits in someone’s personal workspace. This checklist generates a complete AI deprovisioning list tailored to the tools they used, their role, and how sensitive their data access was.
Why AI offboarding is harder than standard offboarding
Standard IT offboarding assumes access flows through centrally managed accounts — Active Directory, Google Workspace, Okta. Disable the account and the access ends. AI tools break that assumption in several ways:
- Personal API keys are created by individuals and often shared with or hard-coded into scripts, CI pipelines, or local automation. They persist until explicitly rotated, regardless of whether the person’s account is disabled.
- Browser-stored sessions for chat assistants do not always expire. A device not wiped by IT can still reach a logged-in workspace days or weeks after departure.
- Shared team accounts for tools without enterprise SSO (common with consumer AI products) have credentials the leaver may still know.
- Custom GPTs and agents built under a personal account become inaccessible or are at risk of deletion when the account is closed, and they may contain proprietary prompt logic.
- Fine-tuned models uploaded to a provider under a personal account are tied to that account; the model and its training data uploads need to be transferred or deleted.
- Chat history can contain confidential information submitted by the user during their tenure. Some providers retain this for months; a deletion request may be needed.
How it works
You select which AI tools the leaver used (chat assistants, coding assistants, API access, custom GPTs or agents, image tools), their role, and their data access level. The tool assembles the relevant steps and orders them by urgency: rotate any API keys they could have seen, remove them from shared and enterprise accounts, transfer ownership of AI-generated assets and fine-tuned models, and — where sensitive data was involved — request data deletion from the providers. Critical steps are flagged, the readiness bar tracks completion, and you can export the whole record for your offboarding ticket.
The step that most often gets skipped
The single most commonly missed offboarding step for AI tools is API key rotation. An API key the leaver knew — even one provisioned in the company’s name, not theirs — is a live credential as long as it exists. It can be in a script they wrote, a dotfile on their machine, a note in their password manager, or simply memorised. Revoking the login changes nothing about that key. Any key the individual could have accessed should be rotated at or before departure, not deferred.
Tips and notes
- Rotate keys, do not just disable logins. A still-valid API key the leaver knew is a live credential regardless of their account status.
- Hunt for shared accounts. Team chatbot logins and shared API keys are the most common orphaned-access path after a departure.
- Transfer before you revoke. Move custom GPTs, prompt libraries, and fine-tuned models into team ownership while the person can still hand them over.
- Document provider deletion requests. If you asked an AI provider to delete data, keep the confirmation for your privacy and audit records.
- Update your standard offboarding checklist. This should not be a separate one-off review — add AI tools explicitly to your IT offboarding SOP.