Revoke an AI Agent’s Access to Your 1Password Vault

Revoking an AI agent’s access to a 1Password vault stops it from using credentials and other items it could previously reach. The right steps depend on how access was granted: through a 1Password service account, a shared vault, a connected app, or a computer where the agent runs. Before you begin, identify the account and integration involved, and make sure you can still sign in to 1Password as an owner or administrator.

What You’ll Need

• Access to your 1Password account, and owner or administrator permissions if the agent was set up for a team.
• The agent or integration name, its service account or user account, and the vaults it could access, if known.
• Access to the machine or hosting environment where the agent runs, if you need to stop it or remove a locally stored credential.

Step-by-Step

1. Stop the agent from running. Pause or shut down the agent in the application, automation platform, or hosting environment that runs it. This reduces the chance it will continue making requests while you change access. If you cannot stop it immediately, proceed with revoking its 1Password credentials first.
2. Identify how it authenticates. Check the agent’s setup documentation and configuration for a 1Password service account, a team member account, a CLI sign-in, or an integration that uses a shared vault. Do not paste tokens, secret keys, or passwords into messages or support requests. If you are unsure, review your account’s service-account and team-member records and ask the person who configured the agent.
3. Revoke a service account if it was used. Sign in to the 1Password web app with an owner or administrator account. Open the administration or people-management area and look for Service Accounts. Select the account assigned to the agent, confirm that it is the correct one, and choose the available option to revoke, suspend, or delete it. Labels and locations can vary by account type and interface. Revoking the service account prevents future authentication with its credentials; deleting or revoking is generally preferable to merely removing one vault grant when you want to end access completely.
4. Remove its vault access if the credential remains in use elsewhere. If you need to preserve the service account for another approved task, edit its vault permissions instead. Remove access to each vault the agent should no longer use, and save the change. Check every vault, not just the one you first noticed. A service account may have access to multiple vaults, and access to a vault can expose many items within it.
5. Disable a dedicated team member account, if applicable. If the agent was configured with a separate 1Password team member login, an owner or administrator should suspend or remove that account using the team’s people-management controls. Avoid disabling a human’s account if the agent shared it; that can lock out the person as well. In that case, remove the agent’s session or credential and have the person change their sign-in credentials as appropriate.
6. Revoke related app access and sessions. Review connected apps, integrations, and active sessions in your account settings. Remove any integration that was granted access for the agent, and sign out or revoke sessions associated with its dedicated account where the option is available. This is a separate check: removing vault permission does not necessarily uninstall an integration or stop a running process.
7. Remove credentials from the agent’s environment. Delete the 1Password token, secret key, CLI session data, or environment variable from the agent’s configuration and hosting system. Remove copies from deployment settings, secret stores, backups, and logs where feasible. Do not rely on deleting a local file alone: a copied credential may still work until it is revoked at the 1Password account level.
8. Check for affected workflows and verify revocation. Review the agent’s scheduled jobs and dependent applications so they do not keep retrying with invalid credentials. Then check the relevant service-account or access settings and, if available, sign-in or audit activity. Confirm the account is revoked or lacks vault permission. Do not test with a real secret or expose vault contents just to prove the change.

Common Mistakes

• Removing only one item’s access. An agent may reach other items in the same vault. Review all vault grants, not only individual passwords you remember sharing.
• Deleting configuration but leaving the credential valid. A token copied elsewhere may still authenticate. Revoke it in 1Password, then clean up stored copies.
• Removing the wrong account. Confirm the service account or team member is dedicated to the agent. Disabling a shared human account can disrupt that person’s work.
• Assuming stopping the agent revokes access. Pausing a process does not invalidate a credential. Complete the account-side revocation as well.
• Forgetting other access paths. The agent may have a separate integration, another service account, or permission to additional vaults. Check each route independently.

Tips

• Record the agent’s name, the account you revoked, the affected vaults, and the date. Avoid recording secrets themselves.
• For future agent access, use a dedicated service account with access limited to the specific vaults and tasks required, rather than a personal account.
• Keep agent credentials in an appropriate secret-management facility, restrict who can read them, and rotate or revoke them when the agent is retired or its access needs change.
• If you suspect a credential was copied or exposed, revoke it promptly and review account activity for unexpected access. Change any affected credentials stored in the vault if exposure may have included those credentials.

Troubleshooting

You cannot find Service Accounts. You may be signed in to the wrong account, lack administrator permissions, or be using a plan or interface where the controls differ. Ask the account owner to check the administration area. The person who originally configured the integration may also know whether it uses a service account or another sign-in method.

The agent still appears to work. It may be using a different account, a second credential, or cached data it obtained before revocation. Check other service accounts, team-member access, connected apps, and vault grants. Stop the agent and remove its local session data. Revocation prevents future authorized access but cannot make the agent forget information it already retrieved.

A required workflow stopped working. First confirm whether the agent was also used by an approved process. Do not restore broad access just to make the error disappear. If access is still needed, create or configure a dedicated account with only the required vault permissions, then provide its new credential through a secure method.

You lack permission to change access. Contact the 1Password account owner or administrator and provide the agent’s name and the access path you found. Do not send them the credential itself. If you cannot identify the account and believe access is active, ask an administrator to review service accounts, vault permissions, and account activity.

Frequently Asked Questions

Does revoking a service account delete the data it already accessed?
No. Revocation blocks future access through that account; it does not erase data the agent previously read, copied, or stored. Remove those copies from the agent’s systems where possible, and change exposed passwords or other credentials as needed.

Is removing vault access enough?
It can be enough to block access to that vault, but it does not necessarily disable the account or remove access to other vaults. Review every grant and revoke the credential entirely if the agent should no longer use 1Password.

Will revoking access stop a running agent immediately?
It should prevent new successful requests using the revoked authorization, but a running process may continue operating on data it already has. Stop the process separately and check for cached or copied data.

Can I revoke access without changing my own 1Password password?
Usually, if the agent used a separate service account or dedicated account, revoke that access directly. If it used your own credentials, sign out its sessions, remove stored copies, and change your password if it may have been exposed. Follow your account’s security prompts.

How can I tell whether the agent had access to more than one vault?
Inspect the service account’s vault permissions or the dedicated team member’s access list in the administration controls. If you cannot view them, ask an owner or administrator to check before considering the revocation complete.

Related

• Email Keeps Stopping? Causes and Fixes
• Titans Ultra Boss Rush Codes: What Works Now?
• Pokémon GO Raid Schedule in February: What to Know