---
title: "Hand a device to a new owner without the · Agent Wranglers"
url: https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/owner-transfer
id: IOT-43
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1078
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Hand a device to a new owner without the old owner's access

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: IOT-43
- Level: Recommended
- Chapter: [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md)
- Rule: Give owners a release step in the app that removes their link, data and shared users from the device before they sell it. A buyer whose seller forgot can reclaim the device only by a factory reset with physical access.
- Check: An end-to-end test releases a device from account A. Account A loses access within 60 seconds and account B claims it. A second test resets a still-claimed device with the button, and account A receives a notice and loses access. A support tool call that moves ownership without a reset fails.
- How: Second-hand devices often arrive still tied to the seller's account. The seller can then watch the buyer's camera, and the buyer cannot set the device up. The release step runs the same erasure as [factory reset erases every owner's data and keys](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/factory-reset.md), from the cloud side. A reset with a button press on the device also ends the old owner's claim, so a stolen account cannot block a lawful buyer. Tell the old owner by email or push when a reset ends their access. The new owner then claims as [claim a device with a one-time code](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/claim-codes.md) says. Never let a support agent move ownership on a claim of purchase alone.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
def release_device(db, notifier, account_id: str, serial: str) -> None:
    device = db.devices.find(serial)
    if device.owner_id != account_id:
        raise PermissionError("Only the owner can release this device")
    db.device_data.delete_all(serial)
    db.device_shares.delete_all(serial)
    db.devices.clear_owner(serial)
    notifier.send(account_id, f"Device {serial} is no longer linked to your account")
```

### Go example

```go
func ReleaseDevice(db DB, notifier Notifier, accountID, serial string) error {
	device, err := db.FindDevice(serial)
	if err != nil {
		return err
	}
	if device.OwnerID != accountID {
		return errors.New("only the owner can release this device")
	}
	if err := db.DeleteDeviceDataAndShares(serial); err != nil {
		return err
	}
	if err := db.ClearOwner(serial); err != nil {
		return err
	}
	return notifier.Send(accountID, "Device "+serial+" is no longer linked to your account")
}
```

## Sources

- [ETSI EN 303 645 V3.1.3, provisions 5.11-1 to 5.11-4](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf)

## Related rules

- IOT-8 [Factory reset erases every owner's data and keys](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/factory-reset.md) in Connected devices
- IOT-6 [Claim a device with a one-time code instead of its serial number](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/claim-codes.md) in Connected devices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/owner-transfer">Agent Wranglers connected devices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Pair Bluetooth LE with LE Secure Connections](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/ble-secure-connections.md)
- [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md)