The habit worth building: review agent permissions periodically, the way you would review which apps can access your phone's camera.
Why it matters. An agent acts under your authority. Permissions are narrow and time-limited by design, but an agent you set up for a project last quarter and forgot about is still an agent holding access.
What to look for:
Agents you no longer recognize or no longer use
Anything scoped more broadly than the job actually requires
Anything pointed at your Core ID where an alias would do
Revoking is immediate and available at any time. That option exists precisely so it gets used — revoking is not an emergency measure, it is routine maintenance.
When you provision the next one: grant the narrowest scope that does the job, and set the shortest lifetime you can live with. Use a provisioning token from the Agent Factory rather than sharing a static secret.
Review your agents at uiid.me.