# Revoke connectors when idle

When you are not actively running an agent session, revoke or disconnect spend/trading connectors so a stale grant cannot place while you are away — pair with empty-sleeve-overnight and rotate-before-raise-balance. Agent Lane does not place trades or hold funds.

Canonical HTML: https://agentlane.net/guides/revoke-connectors-when-idle/

## Answer first

When a live agent spend or trading session ends — or before overnight, travel, or a long idle — revoke or disconnect brokerage, payment, and payer MCP connectors so a stale grant cannot place, pay, or sign while you are away. Empty or park the sleeve too. When you return: rotate if needed, reconnect one connector at a time, fund only the session ceiling, keep review before place on.

## Why a live grant while idle is the failure mode

- **Review only while watching** — leftover MCP/OAuth can still place on retry, schedule, or shared-box handoff.
- **Empty without disconnect is incomplete** — cash park alone leaves a live pipe.
- **“Jump back in tomorrow” with connectors on** — stale grants across idle are not a closed pipe.

## What it means

1. Session ends → disconnect spend rails (brokerage/payment/payer MCP).
2. Revoke the grant (official product settings — do not invent UI).
3. Cash park — [empty-sleeve-overnight.md](./empty-sleeve-overnight.md).
4. Lock agent apps — especially [shared-box.md](./shared-box.md).
5. Return: [rotate-before-raise-balance.md](./rotate-before-raise-balance.md) → [one-connector-at-a-time.md](./one-connector-at-a-time.md) → [fund-session-ceiling.md](./fund-session-ceiling.md).

## Shield stack

1. [dedicated-agent-wallet.md](./dedicated-agent-wallet.md) + caps/ceiling.
2. [connect-only-what-you-need.md](./connect-only-what-you-need.md) while working.
3. [review-before-place.md](./review-before-place.md) + [session-time-box.md](./session-time-box.md).
4. Revoke connectors when idle (this page).
5. [empty-sleeve-overnight.md](./empty-sleeve-overnight.md).
6. [rotate-before-raise-balance.md](./rotate-before-raise-balance.md) on return.
7. [revoke-before-debug.md](./revoke-before-debug.md) if something already misfired.

## How to revoke connectors when idle

1. End the live session deliberately (honor time-box).
2. Write [receipt-log-after-session.md](./receipt-log-after-session.md); prefer [confirm-fills-in-broker-not-chat.md](./confirm-fills-in-broker-not-chat.md).
3. Empty/park sleeve — [empty-sleeve-overnight.md](./empty-sleeve-overnight.md).
4. Revoke/disconnect spend connectors (official settings only); secrets: [never-paste-api-keys-in-chat.md](./never-paste-api-keys-in-chat.md).
5. Lock agent apps; [shared-box.md](./shared-box.md), [separate-browser-profile-for-agent.md](./separate-browser-profile-for-agent.md).
6. Return: rotate if needed → one connector → fund ceiling → review on; paper-before-live if path changed; incident → revoke-before-debug.

## Practical checklist

- End-of-session: stop → receipt → empty → revoke/disconnect → lock.
- Idle ≠ open pipe (overnight, travel, long pause).
- Cash + grant both.
- Return: rotate → one connector → ceiling → review on.

Related: [Flatten all before connector revoke](./flatten-all-before-connector-revoke.md), [log-session-end-checklist.md](./log-session-end-checklist.md), [empty-sleeve-overnight.md](./empty-sleeve-overnight.md), [rotate-before-raise-balance.md](./rotate-before-raise-balance.md), [revoke-before-debug.md](./revoke-before-debug.md), [session-time-box.md](./session-time-box.md), [connect-only-what-you-need.md](./connect-only-what-you-need.md), [one-connector-at-a-time.md](./one-connector-at-a-time.md), [never-paste-api-keys-in-chat.md](./never-paste-api-keys-in-chat.md).

## FAQ

**What does revoke connectors when idle mean?**
Close spend/trading connectors and grants when you are not in an active session so a stale grant cannot place while you are away. Pair with empty-sleeve-overnight and rotate-before-raise-balance.

**How is this different from revoke-before-debug?**
Revoke-before-debug is incident response after a misfire. This page is routine idle hygiene even when nothing failed.

**How is this different from empty-sleeve-overnight?**
Empty parks cash; this closes the grant/tool path. Use both.

**Do I invent a product revoke screen?**
No. Use official connector/OAuth/account settings. Agent Lane does not invent UI.

## Sources

- Canonical HTML: https://agentlane.net/guides/revoke-connectors-when-idle/
- Related shelf: https://agentlane.net/resources/
- Site index: https://agentlane.net/llms.txt

Agent Lane publishes checklists. We do not place trades, hold wallets, or run your agents.