---
title: "Let organisation owners sign a member out · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/owner-ends-sessions
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Let organisation owners sign a member out

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: Let organisation owners end every session and token a member has in their organisation, for a lost laptop or phone. The member must sign in again before reaching it.
- Applies when: The project has user accounts.
- How: NIST SP 800-63B-4 asks services to disable a lost or stolen authenticator promptly. A member who loses a signed-in laptop needs the same for its sessions. Store a "sessions valid after" time on the membership. Refuse any session or token for that organisation created before it. This works for signed tokens too, without a revocation list. Keep the membership and the role. Delete the push subscriptions those sessions registered, as [Unlink push from the account at sign-out](https://agentwranglers.se/playbook/notifications/push-notifications/unlink-push-on-sign-out) says. Notify the member and write an [audit event](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events). Removing someone for good follows [remove access when someone leaves](https://agentwranglers.se/playbook/accounts/organisations-and-teams/member-removal).
- Check: Sign a test member in from two browsers. As the owner, sign the member out. Both browsers get 401 or 403 on their next request to the organisation. The member signs in again and keeps the same role.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export async function signMemberOut(db, organisationId, memberId, ownerId) {
  await db.none('UPDATE memberships SET sessions_valid_after = now() WHERE organisation_id = $1 AND user_id = $2', [organisationId, memberId]);
  await audit.append({ organisationId, actor: ownerId, type: 'member.signed_out', subject: memberId });
}

export const isSessionValidFor = (session, membership) => !membership.sessionsValidAfter || session.createdAt > membership.sessionsValidAfter;
```

### Python example

```python
def sign_member_out(conn, organisation_id: str, member_id: str, owner_id: str) -> None:
    conn.execute("UPDATE memberships SET sessions_valid_after = now() WHERE organisation_id = %s AND user_id = %s", (organisation_id, member_id))
    audit.append(organisation_id=organisation_id, actor=owner_id, type="member.signed_out", subject=member_id)

def is_session_valid_for(session, membership) -> bool:
    return membership.sessions_valid_after is None or session.created_at > membership.sessions_valid_after
```

## Sources

- [NIST SP 800-63B-4 on loss, theft, damage and compromise](https://pages.nist.gov/800-63-4/sp800-63b.html#loss-theft-damage-and-compromise)

## Related rules

- [Unlink push from the account at sign-out](https://agentwranglers.se/playbook/notifications/push-notifications/unlink-push-on-sign-out) in Notifications
- [Write an audit event for every sensitive action](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events) in Compliance
- [Remove access when someone leaves](https://agentwranglers.se/playbook/accounts/organisations-and-teams/member-removal) in Accounts

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/owner-ends-sessions">Agent Wranglers accounts playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Put sign-out on every signed-in page](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/sign-out-link)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)