How Do You Revoke an AI Agent? Approval Boundaries and Audit Trails for Engineering Workflows

This talk examines what changes once an AI agent can do more than generate text: when it can access tools, investigate systems and potentially trigger consequential actions. It addresses how to structure read, recommend and execute permissions, where to place human approval points, and how to apply scoped credentials and revoke them. It also covers how to leave a useful evidence trail across an agent workflow.
Speaker - Hammed Ajibade (https://www.linkedin.com/in/hammed-ajibade-010bb2116/)
Hammed Ajibade is a Lead Software Engineer at Pulse. He builds and leads software across payment systems, platform engineering, mobile products and practical AI tooling. His work sits close to money movement, where systems have to stay reliable under real use.

Transcript

1. AI SECURITY ENGINEERS LONDON · 28 OCT 2026 HOW DO YOU REVOKE AN AI AGENT HAMMED AJIBADE READ RECOMMEND EXECUTE IRREVERSIBLE A G E N T M A N DAT E S
2. A TRUE STORY FROM LAST WEEK MY AGENT SUBMITTED THE SAME FORM TWICE. D E V I E C E R N O I S S I M B ✓ SU from form sent by ade b i j A d Hamme one e m a s the U D ✓ S Hammed from UBMISSION RECE I form Two runs. One identity. Nobody could tell them apart. Not even me. E T A C I PL sent by VED Hammed Aji bade the same o ne Hammed
3. W H AT C H A N G E D FROM TEXT TO ACTIONS. DEPLOY SUBMIT PAY DELETE PUBLISH
4. THE SAME-USER PROBLEM YOUR AGENT IS YOU. You can't narrow it, stop it or audit it without doing the same to yourself. You HAMMED@WORK Your agent HAMMED@WORK ONE USER to every system it touches.
5. TO BE CLEAR DO MY WORK. DON'T BE ME. W H AT W E WA N T W H AT W E U S U A L LY B U I L D "Do this job for me." "Be me while you do it." DELEGATION Its own identity. One job. Can be stopped. IMPERSONATION My login. Everything I can do. Can't be told apart. The goal isn't less delegation. It's delegation you can see, limit and stop.
6. W H AT T H E A G E N T C A R R I E S ONE PASS. TWO NAMES. T O D AY D E L E G AT E D name Hammed on behalf of Hammed can do everything I can carried by agent X, run B expires when I log out allowed submit this one form expires in 15 minutes The work stays in my name. The agent just isn't wearing my face. (OAuth token exchange, RFC 8693)
7. 8 3 Destructive, no way back INCIDENTS. FOUR WEEKS. ONE PERSON'S AGENTS. Mine. Real automations, real production. 2 Acted outside the job 1 Off switch ignored 1 Two runs, one identity 1 No budget, locked me out
8. NONE OF THIS IS NEW. Banks have let strangers act on your account, safely, for decades.
9. THE DIRECT DEBIT, APPLIED TO AGENTS Direct debit Direct debit Direct debit Agent: one agent, one job Agent: actions, volume, spend, expiry Agent: revoke outside the agent Direct debit Direct debit Direct debit Agent: second key or a way back Agent: every action names its mandate Agent: once means once ONE PAYEE, ONE PURPOSE THE GUARANTEE AMOUNT AND SCHEDULE EVERY COLLECTION HAS A REFERENCE The company never gets your bank login. CANCEL AT YOUR BANK NEVER TAKEN TWICE
10. THE FRAMEWORK AGENT MANDATES Agents act under a mandate, never under your identity.
11. W H AT A M A N D AT E S A Y S A PERMISSION SLIP, NOT A LOGIN. Anything not written on it is refused. MANDATE FORM-SUBMIT / RUN 2026-10-20-A grantor Hammed Ajibade holder form-submit, this run only purpose submit approved forms scope execute: listed sites only limits 5 submissions, 0 spend expires 12:00 today second key withdrawals, account changes revoke at grantor's console, not the agent
12. H O W A M A N D AT E A C T U A L LY W O R K S FROM GRANT TO REVOKE. 01 02 03 04 The run starts. Your console writes the mandate where the agent can't edit it. The run gets a mandate ID and a short-lived token. Never your login. Before every action: on the list? under the limit? not expired? not done already? Flip it in your console. The next action is refused. Every step is logged. GRANT BUILT WITH: a database row or policy store ISSUE BUILT WITH: token exchange, AWS STS, GitHub App tokens CHECK BUILT WITH: an API or MCP gateway, a policy engine REVOKE BUILT WITH: an appendonly log My duplicate form: run B needs its own mandate, and the form's once-key refuses the second submit.
13. A P P R OVA L B O U N DA R I E S NOT EVERY ACTION WEIGHS THE SAME. An injected agent can only do what its mandate allows. READ Allowed within scope. RECOMMEND Allowed. Nothing leaves the agent. EXECUTE Only when named in the mandate. IRREVERSIBLE Second key, or a tested way back.
14. A G E N T M A N D AT E S I N O N E S L I D E SIX PRINCIPLES. 1 2 MANDATE, NOT IDENTITY BOUNDED BY DEFAULT GRANTOR HOLDS THE OFF SWITCH 4 5 6 IRREVERSIBLE NEEDS A SECOND KEY EVERY ACTION HAS AN OWNER 3 ONCE MEANS ONCE
15. PRINCIPLE 1 OF 6 MANDATE, NOT IDENTITY. The agent has its own identity, and each run has its own. It holds a mandate from you. W H AT I T S T O P S THE FORM SUBMITTED TWICE. THE POST IN THE WRONG BRAND. Both ran as me. Neither could be told apart.
16. PRINCIPLE 2 OF 6 BOUNDED BY DEFAULT. W H AT I T S T O P S THE AUDIT THAT EDITED. THE JOBS THAT ATE MY QUOTA. Asked to look. It changed things. Purpose, scope, limits and an expiry. Standing access is not a mandate.
17. PRINCIPLE 3 OF 6 THE GRANTOR HOLDS THE OFF SWITCH. Revocation works without the agent's cooperation, and you can prove it stopped. The agent can't edit its own mandate. W H AT I T S T O P S THE PAUSED JOB THAT KEPT RUNNING. The pause was a flag the job was trusted to read.
18. PRINCIPLE 4 OF 6 IRREVERSIBLE NEEDS A SECOND KEY. Approve one action, not the agent. Or verify a way back first. Deleting the way back counts as irreversible. W H AT I T S T O P S ACCOUNTS WIPED. A ROLLBACK WITH NO IMAGE LEFT. Three outages, every one selfinflicted.
19. PRINCIPLE 5 OF 6 EVERY ACTION HAS AN OWNER. W H AT I T A N S W E R S WHO APPROVED THAT. With evidence, not a guess. Each action names its holder, its mandate and the person who granted it.
20. PRINCIPLE 6 OF 6 ONCE MEANS ONCE. A retry, restart or second run never repeats an effect that already happened. A timeout is ambiguous, not failed. W H AT I T S T O P S THE RETRY THAT DID IT AGAIN. Payments learned this years ago: idempotency keys.
21. SO, HOW DO YOU REVOKE AN AI AGENT THREE THINGS THAT WORK. 01 EXPIRE BY DEFAULT Access ends on its own. 02 03 ENFORCE OUTSIDE Run A17 allowed. Revoke mandate A. Next action: A17 denied. Keep the denial record. Never a flag the agent reads. TEST THE SWITCH If you've never pulled it, you don't have an off switch.
22. E DEY WORK? ME E DEY WORK? MY AGENT YES BOSS. ALL TESTS PASSED. Pidgin for "is it working?" The agent's answer is always yes. MEANWHILE tests 3 failed exit code 1 summary "all good"
23. THE EVIDENCE TRAIL WRITE DOWN THE WHY, NOT JUST THE WHAT. An agent's summary is a claim. The exit code is evidence. Append-only. Tamper-evident. Readable by an auditor. EXAMPLE ACTION RECORD action deploy api to production class irreversible holder deploy-bot, run 7f3 mandate release-14, expires 18:00 grantor H. Ajibade second key lead, after diff + plan review way back image api:1.41 verified present verified CI and live health checks passed idempotency release-14/api/1.42
24. M AT U R I T Y WHERE IS YOUR TEAM TONIGHT. 0 1 BORROWED IDENTITY OWN CREDENTIALS Limits live in prompts. Narrowed, but standing. 2 MANDATED Per run, expiring, revocable from outside. 3 ACCOUNTABLE Second keys, once means once, a record for every action.
25. TA K E T H I S T O W O R K O N M O N D A Y SEVEN CHECKS FOR ANY AGENT. 1 Tell its actions apart from yours, and from its other runs. 2 Its access expires on its own. 3 List what it may do, by action class and resource. 4 Revoke it now. Prove it stopped. 5 Name what stands in front of each irreversible action. 6 For last week's actions, name the mandate and the grantor. 7 Retry its last run. Nothing happens twice.
26. DON'T LEND YOUR AGENT YOUR IDENTITY. GIVE IT A MANDATE. HAMMED AJIBADE GITHUB.COM/AJIBADEDAPO/AGENT-MANDATES