Can a fired employee still use your company’s AI at two o’clock?

Often, yes. Disabling a fired person’s sign-in account no longer ends their access when AI tools are in use. API keys, tokens and agents can sit outside that account. They keep working after the person has gone.

Try a simple test. Say the termination meeting is at ten in the morning. At two o’clock that afternoon, could anything the person set up still reach your data? A chat account, a saved key, a scheduled agent, a browser extension? If you cannot answer with confidence, your offboarding has a gap.

The risk starts before the meeting. Cyberhaven’s Q1 2024 Insider Risk Report found a 720% increase in data exfiltration in the 24 hours before employees were told of a layoff, compared with the baseline. The same report names generative AI tools as the third most common route out, after personal cloud storage and removable media.

Why isn’t disabling their SSO account enough?

Single sign-on only cuts off the apps it knows about. You disable the person in your identity provider, such as Okta, Microsoft Entra ID or Google Workspace. Apps connected through it lose the account. That part works.

The gaps sit around the edges. Sessions that are already open may not end straight away. A key the person created inside a service belongs to that service, and only that service can cancel it. Content they shared outside the company stays shared.

AI tools widen those gaps. Coding assistants and agents connect to systems such as GitHub, Jira or a data warehouse. Many of those links use a key saved on the person’s own laptop. Connections that sign in through your identity provider usually fall with it. A key pasted into a settings file never passed through it, so it stays valid.

Your ticket can say access revoked while that key still works. Switching off the account is only the first step.

Where do a fired employee’s AI credentials hide?

They hide in local files, admin consoles, shared pools, browsers and personal accounts. Each one needs its own check, because none of them answers to your sign-in system.

• Settings files on the laptop. AI coding tools often keep keys in environment files, shell profiles or editor settings.
• Personal access tokens. GitHub, GitLab and cloud consoles let people create long-lived tokens tied to their name.
• Shared team keys. A key from a team pool may have been copied into the person’s own tools.
• Browser extensions. An AI extension may hold a grant to read mail, documents or calendars on the person’s behalf.
• Personal AI accounts. A personal login to a chat tool sits entirely outside your control.
• Agents and automations. Scheduled jobs, bots and workflows built under the person’s name keep their rights until someone moves them.

The OWASP Non-Human Identities Top 10 for 2025 ranks improper offboarding as its first risk, NHI1. OWASP describes keys and service accounts that stay active after their owner leaves, and an ex-employee using still-valid credentials after their own account was revoked.

What should you map before the termination meeting?

Map every key, token, AI connection and shared secret the person holds before they are told. For a firing, security and IT should hear first. That way revocation follows a plan.

Run these checks for the person:

1. Pull the tokens and keys tied to them in GitHub, GitLab, your cloud consoles and your identity provider.
2. List the AI tools, extensions and agent connections they used.
3. Pull their password vault membership.
4. Flag every shared credential they could see for rotation.
5. Name a new owner for each service account, agent and automation.

Keep this work read-only. Removing someone from a channel or a shared drive the day before signals what is coming. Colleagues notice too. Watch the logs instead. A sudden rise in downloads or exports is worth noting for the record.

What do you revoke first when the meeting starts?

Start revoking during the meeting, or just before it. Never wait until afterwards.

First, disable the account in your identity provider. Then end open sessions in each major app, because a disabled account does not always close a live session. Each admin console has its own sign-out control.

Next, revoke each key at the service that issued it. Go to GitHub, Slack, your data platform and your deployment system. Delete every key and token on your map. Then confirm each connection fails, and note the time.

Do not wait for the laptop to come back. Couriers take time. An agent with a valid key can keep running in that gap. Once a key is revoked at source, the copy on the laptop is harmless text. Treat a device wipe as a backstop.

If you use an enterprise AI workspace, suspend the person’s seat rather than deleting it. Keep their chat history before you hand the licence to someone else. It may matter for an audit or a legal hold.

What about personal AI accounts and the data they pasted?

You cannot switch off a personal account. Whatever the person pasted into a personal chat tool stays with them and with that vendor. Saved memory and custom instructions go with it.

So the work here happens before anyone leaves. Set a clear policy that company data goes only into company AI accounts. Give people an approved tool, so they have no reason to use their own. Company accounts are the only ones you can suspend.

When someone is fired, ask your counsel what you can request. Review what they had access to and what they may have pasted. Treat any secret that went into a personal tool, such as a key or a password, as exposed and change it.

Who owns the agents and automations they built?

Every agent, bot, scheduled job and workflow needs a named owner who still works for you. Move each one to the person you chose before the meeting.

Check scheduled jobs with care. A nightly agent built under the former employee’s name may fail when their account goes. Worse, it may keep running on old rights. Rebuild it under a service identity your IT team controls.

Clear browser extensions the same way. Remove third-party app grants the person approved in Google Workspace or Microsoft 365. On managed browsers, block AI extensions you have not approved.

Then look back at what each agent did in the final days. Pull the logs from every system it touched. Many systems record agent actions under the person’s own name, so read them as one trail. Bulk exports, large uploads to AI tools and new connections made in the final weeks all deserve a second look.

Rotate shared passwords and team keys too. Removing vault access stops new access. Rotation closes access the person already knows. You need both. Warn the teams that use a shared key first, so their work does not break.

What if the laptop or phone never comes back?

Treat every credential on it as exposed, and make sure each one is already dead at source. That is why revocation comes first. A missing laptop that holds only revoked keys is then mainly a hardware loss.

Collect company laptops at the meeting if you can. If not, start a remote wipe straight away and record the device status: returned, wiped, pending or missing. Set a return window in your policy. If it passes, pass the case to legal.

Personal phones and home computers are harder. You can usually remove a managed work profile, but not a key the person copied into a personal notes app. You cannot see every file on a device you do not own. So confirm in each of your systems that any key which touched the device no longer works.

How do you run the two o’clock test?

At two o’clock, check that every door is shut, then write it down. The test turns a hopeful ticket into evidence.

• Try the revoked keys and confirm each one is refused.
• Confirm the identity account, open sessions and enterprise AI seat are closed.
• Look for new app grants, mail forwarding rules or public file links set during the last days.
• Check that each agent and automation has a new owner or has stopped.
• Log any attempt to sign in or call a service since the meeting.

Record the time, the result and who checked each line. Keep the sheet with the HR file. An audit treats a step with no record as a step never taken. Run the same checks again the next day, because some sessions and forwarding rules only show up later.

Frequently asked questions

Does disabling Okta revoke API keys?

No. Disabling the account removes access to apps that sign in through Okta. A key issued by GitHub or another service stays valid until you revoke it there.

Does this apply to contractors?

Yes. A contract ending is an offboarding event. Contractors often have no laptop to return and no formal exit, so set expiry dates on their keys when they are issued, matched to the contract end.

Who should own the offboarding checklist?

Give it one named owner in IT or security, with HR as a partner. That person adds a row each time a new AI tool reaches your teams. Review the list every quarter, because new tools bring new kinds of access.

Should resignations get the same checks?

Yes. Use one checklist for every exit. A firing simply moves the timeline earlier.

This piece is part of a series for IT and security leaders on running AI safely. You can find the rest on the Handvantage blog.

Your next step

Get the free handbook at workspace.handvantage.com/handbook. There is no email gate. Use it to check your own offboarding before the next exit.