Give each agent email access you can take back

Give two agents their own connections, then revoke one without interrupting the other.

Two agents may need to read verification emails. Give each its own connection, then test that you can revoke one without interrupting the other.

Create two connections

In ActAs, open the first agent's page and select Connection, then Connect CLI. Name the connection. Under Permissions, keep Read email and untick Use secret values. Under Access to inboxes and accounts, tick only that agent's inbox. Choose Create connection, then Download connection. Repeat for the second agent and its inbox.

Each connection file is a credential. Keep it private.

Connect each agent

The CLI normally keeps one connection on a machine. If both agents run on the same machine, give each a separate connection path and use it on every command. For example, for an agent named Scout:

ACTAS_CONNECTION_FILE=~/.config/actas/scout.json actas connect ./scout.json
ACTAS_CONNECTION_FILE=~/.config/actas/scout.json actas resources
ACTAS_CONNECTION_FILE=~/.config/actas/scout.json actas mail <scout-inbox-id>

Use a different path and downloaded file for the second agent, and run the same commands with its inbox ID. On separate machines, each agent can use the default connection path instead: run actas connect ./actas-identity.json, then actas resources and actas mail <inbox-id>.

After connecting, delete each downloaded connection file. The CLI keeps its own private copy. Send a test message to each inbox and check that each agent can list its messages.

Revoke one connection

Return to the first agent's Connection tab. On the connection's row, choose Revoke access. The row shows Revoked. For this test, use the row's Revoke access, not Disconnect agent…, which turns off all of that agent's connections.

Repeat the first agent's actas mail command with its connection path. The CLI reports:

{"status":"failed","message":"Access expired or was revoked. Reconnect through your workspace."}

The server returns HTTP 401. Run the second agent's actas mail command again; it can still list the messages in its permitted inbox.

Revoking a connection stops future access through that connection. It does not erase credentials already retrieved or automatically sign out sessions at another service. If an agent may have copied a credential or opened an external session, rotate or revoke those at the service as well.

If you don't use ActAs

Use separate service accounts or credentials for each agent where a provider supports them. Limit each account's permissions, record which agent holds it, and test revocation on a non-production resource. Confirm that removing one credential leaves the other agent's access working. The controls depend on the service.