Auto‑revoke Claude Agent access when a user is offboarded with Kinde webhooks

Описание и применение

Автоматическое отозвание доступа агента Claude при отчислении пользователя с помощью вебхуков Kinde

Задача

When a user is offboarded, their OAuth access token remains valid, allowing an AI agent to continue acting on their behalf.

Результат

Implementing a webhook‑driven status check before every tool call prevents offboarded users from continuing to act via the agent, closing the security gap caused by stateless OAuth tokens.

Рабочий процесс

• 1. User signs in via Kinde and receives an OAuth token.
• 2. Agent starts a task and makes tool calls based on the token’s claims.
• 3. Kinde sends a webhook when the user is suspended or deleted.
• 4. App receives the webhook and updates its internal user status to "offboarded".
• 5. Before each tool call, enforceToolCall checks the current user status via decideAccess.
• 6. If status is "offboarded", the call is refused and the agent stops acting.
• 7. The agent’s loop ends or retries with a refusal message.

Доказательства

Unsurprisingly, the agent kept working on the task.

Источник

A webhook tells the app when Kinde's view of a user changes, and a check runs before every single agent action

Источник