---
title: "Remove the previous team's access inside · Agent Wranglers"
url: https://agentwranglers.se/playbook/codebase-takeover/triage/remove-inherited-access
id: TKO-40
level: Required
risk: takeover
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1033
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Remove the previous team's access inside the product

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TKO-40
- Level: Required
- Chapter: [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md)
- Rule: List every way into the running product that is not a vendor account, and remove each one that no current person or service owns. That covers admin users, SSH keys, deploy keys, API tokens, OAuth apps and webhooks.
- Check: The access list names every admin user, SSH key, deploy key, API token, OAuth app and webhook, each with a current owner. A fresh query of admin users and a scan of every `authorized_keys` file find no entry missing from the list.
- Risk: An account or system taken over
- How: [Take control of every account before touching the code](https://agentwranglers.se/playbook/codebase-takeover/triage/take-control-of-accounts.md) secures the vendor accounts, and [Rotate every secret the previous team could read](https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets.md) replaces shared secrets. A former developer may still hold an admin user in the app, a key in `authorized_keys` or a personal API token. A webhook or an OAuth app can keep sending data to an address the old team controls. Query the users table for admin roles, and read `authorized_keys` for every user on every server. List the deploy keys, installed apps and webhooks in the code host and in each vendor. Remove what has no current owner, and record the rest with its owner in the [system map](https://agentwranglers.se/playbook/codebase-takeover/triage/system-map.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# Every key that can sign in to each server, with its comment
for host in app1.example.com app2.example.com; do
  ssh "$host" 'sudo sh -c "cat /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys 2>/dev/null"' | awk -v h="$host" '{ print h, $NF }'
done
# Deploy keys and webhooks on the repository
gh api repos/example/shop/keys --jq '.[] | [.id, .title, .created_at] | @tsv'
gh api repos/example/shop/hooks --jq '.[] | [.id, .config.url] | @tsv'
```

### SQL example

```sql
-- Admin users in the app, oldest sign-in first
SELECT email, role, last_sign_in_at FROM users WHERE role IN ('admin', 'owner') ORDER BY last_sign_in_at;
```

## Sources

- [NIST SP 800-53 Rev. 5, AC-2 Account Management](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Related rules

- TKO-1 [Take control of every account before touching the code](https://agentwranglers.se/playbook/codebase-takeover/triage/take-control-of-accounts.md) in Codebase takeover
- TKO-2 [Rotate every secret the previous team could read](https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets.md) in Codebase takeover
- TKO-5 [Map the system before changing it](https://agentwranglers.se/playbook/codebase-takeover/triage/system-map.md) in Codebase takeover

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/codebase-takeover/triage/remove-inherited-access">Agent Wranglers codebase takeover playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Rotate every secret the previous team could read](https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets.md)
- Next: [Take a backup and restore it before the first change](https://agentwranglers.se/playbook/codebase-takeover/triage/restore-before-first-change.md)
- [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md)