---
title: "Keep a way to sign everyone out at once · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/sign-everyone-out
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep a way to sign everyone out at once

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: ACC-67
- Level: Recommended
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: Give staff one recorded action that ends every session and refresh token for every user. Run it on staging at least once a year.
- Applies when: The project has user accounts.
- How: OWASP ASVS 5.0 requirement 7.4.5 asks that admins can end sessions for one user or for all users. You need it after a leaked session signing key, a breached session store or a bug that mixed up sessions. With sessions on the server, delete every row. With signed tokens, store one "sessions valid after" time and refuse older tokens. [Let organisation owners sign a member out](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/owner-ends-sessions) does for one organisation. Rotate the signing key in the same step when the key leaked. Copy the session list first when the cause is an attack, as [keep evidence in security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents) asks. Write an audit event naming the staff member.
- Check: On staging, sign in three test users with cookies and one with an access token. Run the action. Every next request answers 401 within 1 minute, and the audit log holds one event with the staff member's ID.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export async function signEveryoneOut(db, staffId) {
  await db.tx(async tx => {
    await tx.none("UPDATE settings SET sessions_valid_after = now() WHERE name = 'global'");
    await tx.none('DELETE FROM sessions');
    await tx.none('DELETE FROM refresh_tokens');
  });
  await audit.append({ actor: staffId, type: 'sessions.all_ended' });
}
```

### Python example

```python
def sign_everyone_out(conn, staff_id: str) -> None:
    with conn.transaction():
        conn.execute("UPDATE settings SET sessions_valid_after = now() WHERE name = 'global'")
        conn.execute("DELETE FROM sessions")
        conn.execute("DELETE FROM refresh_tokens")
    audit.append(actor=staff_id, type="sessions.all_ended")
```

## Sources

- [OWASP ASVS 5.0 V7 Session Management](https://github.com/OWASP/ASVS/blob/master/5.0/en/0x16-V7-Session-Management.md)

## Related rules

- [Let organisation owners sign a member out](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/owner-ends-sessions) in Accounts
- [Keep evidence in security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents) in Operations

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/sign-everyone-out">Agent Wranglers accounts playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Notice when a session cookie moves to another device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/stolen-session-detection)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)