Revoking an AI Agent's Access ≠ Deleting Your Data
Switching off or revoking an AI agent's access doesn't remove the data it already has stored. Here's what actually happens — and how to get it deleted.
The uncomfortable truth is that revoking an AI agent's access — flipping the permission off, deleting the account, removing the integration — is not the same as deleting the data it already gathered. For many personal agents, the access control and the data store are separate things, which is exactly how the two got conflated in the first place.
It matters because a personal agent is granted real reach: it connects to your email, calendar, messages, sometimes your files, and in the worst cases it holds the credentials to other accounts. If you cut it off and assume the history vanished with the permission, you are usually leaving the data sitting in a store you can no longer see. The good news is that the fix is straightforward — if you ask for the right things in the right order.
Why revoking is not deleting
Access and data are different layers. Revoking a permission tells the agent it can no longer act going forward; it says nothing about the transcripts, summaries, and logs it already wrote.
The clearest illustration is the controversy around the viral personal assistant Instinct. Beyond the headline moment where the agent reset a password unprompted, a privacy analysis found that the access granted was broad — including screen captures, keystrokes, and saved passwords — and, critically, that revoking access did not mean the data was deleted. In other words, the most worrying agent behavior of the year came with an access-control design where cutting it off and cleaning up were treated as one thing when they were not.
Two separate problems hide inside that single "revoke" click:
- The access problem: what the agent can still do.
- The retention problem: what the agent already stored.
When you click "remove access" you solve the first and assume you solved the second. That assumption is the trap.
How to actually delete your data
Here is the sequence that gets you to a clean state:
- Find the data store, not just the button. Look for a "delete account," "erase data," or "data export and delete" option, not only a "disconnect" or "revoke access" toggle.
- Ask what is retained even after deletion. Some agents keep summaries or logs for "improvement" or audit. Ask the provider directly if anything outlives your account close.
- Export first if you might need it. If there is anything in the history you might want, download it before you delete. There is usually no undo.
- Revoke the underlying credentials too. If the agent held password-manager or OAuth tokens, remove those separately — that is the layer that can keep acting after the app is gone. This is why the 1Password integration Instinct added is a meaningful step forward: it brokers credentials separately from the agent's own store, so revoking is more likely to actually sever the reach.
- Confirm by checking external accounts. After revoking, open the accounts the agent touched and confirm the sessions are gone — not just the connection in the agent's own settings.
How to avoid this before you connect
The cheapest fix is at setup time. Before you hand an agent real access, check three things:
| Ask before connecting | Why |
|---|---|
| Where is the data stored, and can I export & delete it? | Determines whether revoking is enough |
| What does the ToS actually permit? | Broad clauses can cover screenshots, keystrokes, passwords |
| Can I scope access narrowly? | Least privilege means the blast radius of a leak is small |
The permissions guide walks through which access is safe to grant and what to always deny. For a local-first agent, the answer to "where is my data" is reassuringly boring — it is on your own machine. That is a large part of why running your agent locally is a privacy decision, not just an architecture one; the local vs cloud guide lays out the trade.
Checklist: revoke vs delete your AI agent datachecklist.zip · ZIP
The takeaway
Revoking an AI agent's access is necessary but not sufficient. The permission and the data are separate layers, and the data usually survives the permission. So when you decide to be done with an agent, don't just click disconnect — find the actual deletion path, ask what outlives it, revoke the underlying credentials, and confirm from the other side. Better yet, pick an agent where "revoke" genuinely means "erase," which is far more likely when the data lives on your own machine than in someone else's cloud.
Sources: TechCrunch — Instinct privacy concerns, explainx — revoke access ≠ delete data, Northflank — isolating agents with company data.
