How to Auto-Revoke a Claude Agent's Access When a User Is Offboarded With Kinde Webhooks
Imagine this scenario, someone on your team gets offboarded while their AI agent is still mid-task. Nobody remembers the agent is even running. It's just doing what it was told, on behalf of someone who, as of a minute ago, doesn't work at your company or on your team anymore. Does it stop? Well, I built a small app to test that scenario, using Kinde to handle sign-in and to hold the record of…
In a recent scenario, an AI agent's access was not revoked properly when a user was offboarded from a team. This occurred while the agent was still mid-task, causing potential issues. To address this problem, a small app was created using Kinde to handle sign-in and track active users. The app tested the situation by suspending a user in Kinde's dashboard mid-run, and the agent continued working on the task.
The reason for this is that suspending or deleting a user in Kinde changes how Kinde views the user, but it does not affect the access token the agent is holding. The token remains valid and verifies correctly, leaving no way for the agent to know that its access has been revoked. The solution to this gap involves two key components: webhooks and checks before every agent action.
Webhooks notify the app when Kinde's view of a user changes, while checks before each agent action verify the agent's access against the app's record of the user, rather than relying on the token's validity at the time the session started. The agent in this scenario used Claude Messages API loops to perform actions against a set of internal resources, and the fix involves ensuring that every tool call passes through a function that checks the user's current status and enforces access accordingly.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
