Offboarding someone from your AI tools

Most offboarding checklists were written before AI tools arrived. They disable the email account, collect the laptop and stop there. The person's AI access often survives: a personal API key in a billing account, a connector that still reads the shared drive, an agent that runs under their login, a seat that keeps billing because nobody removed it from the vendor console.

Use this checklist alongside your normal offboarding, on the person's last day. For a planned departure, do the transfer steps in their last week while they can still explain what they built. For an involuntary departure, do the revoke steps first, within the hour, and the transfers afterwards.

This is a starting point. If you handle regulated data or have contracts that set out how access must be removed, check the steps against those requirements, and with counsel where they apply.

Before the last day

• List every AI tool they used. Start from your approved tools list, then check the person's company card statements and expense reports for the last three months. If you sign in to tools through Google Workspace, Microsoft Entra or Okta, export the apps assigned to them.
• Ask them directly. "Which AI tools, keys, automations or agents did you set up that someone else will need?" People forget, but they forget less when asked a specific question.
• Find what runs under their name. Scheduled automations, agents, bots in team chat, integrations in your CRM or help desk, and scripts in code repositories that use an API key issued to them.
• Pick a new owner for each item you want to keep. Write the new owner next to each line of the list.

Revoke on the last day

Seats and accounts

• Remove the person from each AI tool's admin console, or let your identity provider remove them if the tool is provisioned that way. Disabling the email account alone doesn't always end a session that is already signed in, and it doesn't stop the seat from billing.
• Cancel or reassign the seat in billing. Note any minimum seat count on the plan before cancelling.
• If they had admin rights in an AI tool, confirm another admin exists before you remove theirs.

API keys

• On each developer platform account (OpenAI, Anthropic, Google, AWS, Azure or others you use), delete or disable any key they created or used personally.
• For keys shared with a system, rotate them: issue a new key, update the system, then delete the old one. Assume the person had a copy of any key they could read.
• Remove them as a member of those platform accounts and any organization or project inside them.

Connectors and app grants

• In your office suite's admin console, review the third-party apps the person authorized ("Sign in with Google" or Microsoft consent grants) and revoke grants to AI tools. A grant can let a tool read mail or files even after the person stops using it.
• In each AI tool that connects to other systems, remove connectors the person set up (drive, email, calendar, CRM, code host) or move them to a service account owned by the team.
• Remove any meeting note-taker or assistant from their calendar so it stops joining meetings they were invited to.

Agents and automations

• Stop any agent or automation that runs with the person's credentials. Restart it under a dedicated account owned by the team, with only the access it needs.
• Check bots in team chat and help desk integrations for tokens issued to the person.

Transfer what the team needs

• Shared chats, projects and custom assistants. Many business plans let an admin transfer or keep a departed member's workspace content. Check what yours allows before removing the account, because some tools delete content when the user is removed.
• Prompts and templates. Copy anything the team relies on into your shared prompt library, with a named owner.
• Documentation. For each automation or agent, one paragraph: what it does, what it connects to, where its key lives and who to call when it breaks.

Check a week later

• The vendor's next invoice shows the seat gone.
• API usage under the old keys is zero.
• Nothing failed because a key was rotated or an agent was moved. If something did, record it so the next offboarding catches it earlier.
• The person's name no longer appears as owner on any item in your spend register or tools list.

A worked example

Rowan, an operations coordinator at a fictional 30-person landscaping firm, gives two weeks' notice. Their manager asks the question above and gets a list of four things: a team-plan seat on an AI assistant, an automation that drafts weekly crew schedules from the job tracker, a meeting note-taker on their calendar, and an API key on the company's developer account that the scheduling automation uses.

In the last week, Rowan writes a paragraph on the scheduling automation and walks the office manager through it. On the last day, the manager removes the seat, revokes the note-taker's calendar access, issues a new API key owned by a shared operations account, updates the automation with it and deletes Rowan's key. A week later the invoice shows one fewer seat, the old key shows no usage, and Monday's schedule draft arrived on time.

The whole thing took about 90 minutes. Without the question on day one, the automation would have stopped the first time someone deleted Rowan's key, and nobody would have known why.