An AI agent decommissioning checklist covers every step needed to retire an agent safely: stop new work, clear work in flight, hand its tasks to a person or another agent, revoke every credential and connection, keep its records for as long as the decisions it made must be explained, and update the inventory. Each step has an owner and evidence.
Why does retiring an agent need a checklist?
Because agents leave more behind than people do. A person who leaves hands back a laptop and loses a login. An agent may hold several service identities, API keys, connections to other agents, scheduled tasks, queue subscriptions and a stream of records that regulators may ask about for years. Miss one credential and you have an unowned identity with access to production. Lose the records and you cannot explain a past decision.
When should you use it?
When an agent is replaced by a new version or a different agent, when a pilot ends without going to production, when the process it served changes or ends, or when a vendor relationship ends. Pilots are often forgotten: a pilot that did not meet its success criteria still has credentials and records that need closing.
A partial version applies when a single capability is withdrawn. Use the relevant lines rather than leaving that capability's access in place.
How do you fill in each step?
- Decision records who decided to retire the agent and why. A retirement is a change and goes through change control.
- Stop new work at the intake: channels, queues, schedules. Confirm nothing new arrives.
- Work in flight has three kinds: held items waiting for a person, drafts not yet sent, and multi-step tasks part done. Each needs an explicit owner.
- Handover names who does the work now. If a new agent takes over, it must have its own certification, not inherit the old agent's. Reusing the evidence that took the old agent out of shadowing is not enough; the new agent shadows on its own, using criteria like those in the shadowing exit criteria checklist.
- Access removal covers every identity, key, token, connection and permission, verified by an independent person.
- Records stay. Decide retention by the longest obligation that applies to the decisions the agent made.
- Regulatory updates cover registers, notifications and documentation. Where the agent was in scope of the EU AI Act, update the records described in the EU AI Act compliance checklist for AI agents.
The checklist
| No. | Step | Owner | Evidence |
|---|---|---|---|
| 1 | Retirement decision approved through change control | Agent owner | Change record |
| 2 | Staff and affected teams told, with date | Agent owner | Communication |
| 3 | Customers told if the agent was customer-facing | Customer communications | Notice or updated disclosure |
| 4 | New work stopped at all intakes | Operations | Intake configuration, zero new items |
| 5 | Held items reassigned to named people | Operations | Queue report |
| 6 | Unsent drafts reviewed and either sent by a person or closed | Operations | Draft list with outcome |
| 7 | Part-done tasks completed or reversed | Operations | Task list with outcome |
| 8 | Handover to successor confirmed | Agent owner | Successor's certification or team rota |
| 9 | All identities and credentials revoked | IT | Revocation records |
| 10 | Connections to other agents and systems removed | IT | Configuration change |
| 11 | Scheduled jobs and triggers removed | IT | Scheduler record |
| 12 | Independent check that nothing remains | IT risk | Access review result |
| 13 | Records archived with retention period set | Records management | Archive reference |
| 14 | Inventory status set to retired | Governance | Inventory entry |
| 15 | Registers and regulatory records updated | Compliance | Updated entries |
| 16 | Vendor contract exit steps complete, if any | Procurement | Exit confirmation |
A worked sample
A hypothetical lender retiring a first-generation document checking agent, replaced by a new agent.
| No. | Entry |
|---|---|
| 1 | CHG-311, approved by head of lending operations: replaced by new agent with wider document coverage |
| 4 | Upload queue redirected to new agent at 6pm Friday; zero items to old agent by Saturday 9am |
| 5 | 37 held items reassigned to underwriting team leads |
| 6 | 12 draft document requests: 9 sent by underwriters, 3 closed as no longer needed |
| 8 | New agent completed shadowing and certification before switch-over; old agent's certificate not carried over |
| 9 | Two service identities and one API key revoked Monday |
| 12 | IT risk found a read connection to the document store still active; removed Tuesday |
| 13 | Verdicts and actions archived; retention set to match the loan records they relate to |
| 14 | Inventory AG-007 set to retired, successor AG-019 linked |
Step 12 caught a leftover connection. That is why the independent check exists.
Where Pryme fits
In Pryme, retiring an agent ends its certificates and identities, and its filed verdicts remain in the append-only record, so past decisions can still be reconstructed. A successor earns its own depth through Attest. See train, shadow, certify, widen.
Questions people ask
How long should a retired agent's records be kept?
As long as the longest retention obligation for the decisions it made or supported. For lending or claims, that is usually tied to the life of the loan or claim plus a period set by local law.
Can a new version simply replace the old one in place?
Only if you treat it as a change and re-certify. Behaviour can differ even when the job is the same, so the old evidence does not carry over.
Who should sign off decommissioning?
The agent owner, after IT risk confirms access is gone and records management confirms the archive.