Agent lifecycle management

Agent lifecycle management is the work of introducing, changing, suspending, and retiring an agent's operational identity and its associated access. It tracks what the agent is for, who owns it, and when it is allowed to act.

Managing an identity and managing the process that uses it are separate jobs. A disabled identity can leave a process running. A stopped process can leave valid credentials behind.

Explore Dome: Agent Registry · Docs: Agent lifecycle.

Suspension, rotation, and retirement solve different problems

Suppose a scheduled agent is being replaced by a new version. The old deployment has an agent credential, gateway access, a schedule, and a shared backend dependency.

For the replacement, stopping the old schedule prevents new runs; revoking the old identity withdraws its access. Rotating its credential alone may not help if the old process can obtain another valid one.

Dome's lifecycle documentation distinguishes reversible suspension from permanent revocation. The documentation explains which state changes are allowed and how they affect related access.

Explore Dome: Agent Registry · Docs: Manage agents.

Check what depends on the agent before retiring it

Agent decommissioning means taking a workload out of service and dealing with its dependencies. Identity revocation removes its access, but that is only one part of the job.

Before retiring the old agent, identify its schedule, credentials, grants, child identities, model routes, and downstream state. Decide which dependencies are unique to it and which are shared.

Keep a shared backend key available to the services that still need it. Revoke credentials used only by the retiring agent, including any stored in a separate secrets system.

Preserve enough history to interpret past activity. Removing a display record too early can make later audit events harder to attribute. Retention requirements depend on the organization's obligations and operating needs; retirement does not mean deleting every record.

For a hypothetical daily reporting job, the replacement check might require one completed report from the new deployment and confirmation that the old schedule no longer starts work. Run those checks before treating the replacement as complete.

Explore Dome: Audit · Docs: Audit events.

Verify that the access change took effect

After suspension or revocation, allow for the documented delay before the change takes effect, then test the relevant access path. Check the old credential, any session tokens that may still be valid, and any separate direct backend path included in the retirement scope.

Changing an agent's status doesn't establish that an in-flight operation was canceled. If a payment, ticketing, or messaging service has already accepted a request, you may need to check the result and make a separate correction.

Dome controls the registered identity's access through its governed paths. The external runtime and backend systems retain their own state. Agent incident response covers the checks and containment steps needed during an incident.

Record what was disabled, what was retained, which dependencies are still shared, and the test results. The next operator should be able to see what remains active and why.

Explore Dome: Agent Registry · Docs: Agent lifecycle.