Let users revoke one agent without the others

How to do it

Store one grant per user, client and agent, and hang every refresh token from it. Revoking the grant revokes its refresh tokens at once. Keep access tokens short, as Give agent grants short lives says, or check them against the grant on each call. Offer the standard revocation endpoint to clients too, so an agent can hand back its own access. Admins of a team account see and revoke the grants of their members. An operator-wide block is Keep an off switch for each agent operator.

Examples

JavaScript example

export async function revokeGrant(db, userId, grantId) {
  await db.tx(async tx => {
    await tx.none('UPDATE agent_grants SET revoked_at = now() WHERE id = $1 AND user_id = $2', [grantId, userId]);
    await tx.none('UPDATE refresh_tokens SET revoked_at = now() WHERE grant_id = $1', [grantId]);
  });
}

Python example

def revoke_grant(conn, user_id: str, grant_id: str) -> None:
    with conn.transaction():
        conn.execute("UPDATE agent_grants SET revoked_at = now() WHERE id = %s AND user_id = %s", (grant_id, user_id))
        conn.execute("UPDATE refresh_tokens SET revoked_at = now() WHERE grant_id = %s", (grant_id,))

How to check

Give two test agents grants for one test user. Revoke the first in the account page. Within 5 minutes its access and refresh tokens are refused, and the second agent's calls still succeed.

Sources

• RFC 7009 (OAuth 2.0 Token Revocation)

Related rules

• AGT-5 Keep an off switch for each agent operator in Agents as users
• AGT-8 Name the agent on the consent screen in Agents as users
• AGT-10 Give agent grants short lives in Agents as users
• AGT-27 Warn the person before an agent's budget runs out in Agents as users