# Offboard a developer

One action for "this person has left". Classic offboarding checklists cover email and
VPN but never reach AI tooling — API keys sitting in tool configs, live logged-in
assistants, MCP credentials, gateway tokens.

## How

**Users & Teams → Developers** → **Offboard** on their row → confirm.

## What happens, immediately

- **Every device they registered is revoked.** Their gateway tokens stop working, so
  their AI tools lose access at the Gateway — even if their laptop is offline, off, or
  never comes back.
- **Every passkey is removed**, so they cannot sign in to enrol a new device.
- A **receipt** is recorded — how many devices and passkeys were revoked, by whom, and
  when — and the person shows as `Offboarded` in the table.

Their seat is freed for someone else.

## What it does not do

It does not reach into the laptop and delete files. If the machine is still under your
control and online, the Endpoint Suite also removes the Sentilai routing from the tool
configs; if it isn't, access is dead at the Gateway regardless, which is the part that
matters.

## Offboarding an admin

Not a one-click action yet. Revoke their pending invites and remove their passkeys from
**Users & Teams**; a dedicated admin offboarding flow is on the roadmap.

<!-- shot:offboard-developer -->
![Every developer row carries Offboard — one click revokes their AI access and frees the seat.](https://docs.sentilai.com/uploads/images/gallery/2026-08/Yiqoffboard-developer.png)
*Every developer row carries Offboard — one click revokes their AI access and frees the seat.*