Free tools Windows power users keep installed
One-click scans. No signup required.
To find out what an AI agent did, trace its identity through the agent’s event records, your identity provider, and the services it could access. To stop it, disable its identity, invalidate or rotate its credentials, remove connected-app grants, and end active sessions where supported. Then test that access is denied. A single revoke action may not stop every in-flight request or invalidate every downstream copy of a credential.
What an agent audit should show
An audit trail is useful only if it can connect an action to the identity that performed it and the resource it affected. For each relevant event, look for:
As an Amazon Associate I earn from qualifying purchases.
- Identity and context: the agent’s unique identity and, when it acts for a person, the human principal or “on behalf of” context.
- Time and correlation: a timestamp and session, request, or correlation ID that can be matched across systems.
- Action and target: the tool or operation used and the resource it accessed or changed.
- Authorization: effective permissions or scopes, the allow-or-deny decision, relevant policy context, and an approval reference for actions that required approval.
- Outcome: whether the operation succeeded, failed, or was denied.
Include denied attempts and failures as well as successful actions. Keep bearer tokens, API keys, credentials, and unnecessary sensitive content out of logs. OWASP recommends recording decisions, tool calls, and outcomes, monitoring for anomalies, and redacting secrets in its AI Agent Security Cheat Sheet. Microsoft’s guidance also identifies agent identity, role, effective scope, action, resource, correlation ID, and delegated user context as useful audit details: Least privilege for AI agents with Microsoft Entra Agent ID.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow to investigate what the agent did
1. Identify the agent and its owner
Start with an inventory of the agent, its named owner or sponsor, runtime, credentials, tools, integrations, downstream services, and the human context under which it operates. Search audit records using the agent identity and correlate events by session or request ID and time.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prefer a dedicated workload or agent identity over a shared human login or service credential. Shared credentials weaken attribution: a record showing a shared account may not establish which agent acted. NIST discusses this accountability problem and the risk that anyone who obtains a bearer token may be able to present it in Why Agentic AI Needs a Strong Identity Foundation.
2. Check effective permissions, not just the tool list
An agent’s visible tools do not tell you everything it can do. Check the roles, scopes, delegated grants, and downstream identities used by each connector. A connector that appears read-only may rely on a broader downstream account or expose additional operations.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review permissions at the service that holds the data or performs the action. OWASP warns against excessive agency and recommends limiting an agent’s functionality and permissions; see LLM06:2025 Excessive Agency. Do not rely on the model to decide whether an operation is permitted.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →3. Correlate the records across systems
Compare the agent’s own event trail with records from the identity provider and each connected application. Check whether timestamps and IDs line up, whether the downstream service records the acting identity, and whether identity changes or permission updates appear in the timeline. The agent should not be the only source of evidence about its own activity.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Ask who can read or alter the records, whether the agent can modify its own trail, and how long records are retained. Logging guidance supports structured records and monitoring, but it does not establish a universal retention period or guarantee that every product captures every event. Treat gaps as gaps rather than assuming an unlogged action did not occur.
How to revoke an AI agent’s access
Revocation usually involves more than one control. Use the provider’s supported procedures, then verify the result at the services the agent could reach.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Disable the agent identity. Use the identity provider or platform that manages the agent identity. Confirm the identity is disabled rather than merely hidden or removed from a local tool list.
- Invalidate credentials. Revoke or invalidate issued tokens where supported, and rotate exposed secrets, keys, or passwords. A rotated secret does not necessarily invalidate a token already issued from it.
- Remove downstream grants and assignments. Revoke delegated application consent, role assignments, connector permissions, and other access held in connected services. Check for stale grants that remain after the identity is disabled.
- End active sessions or connections. Terminate sessions, refresh-token families, or connector connections where the relevant provider supports it.
- Test and verify. From the agent’s runtime, attempt the relevant workflow and confirm that new requests are denied. Check identity-provider and application logs for the denial and for the permission or identity changes.
Microsoft’s guidance specifically calls for testing disablement, credential rotation, token invalidation, and removal of stale permissions. NIST describes identity lifecycle and revocation mechanisms, including SCIM for cross-system identity management, in its 2026 concept paper on software and AI agent identity and authorization. The actual controls and propagation time depend on the identity provider, connected services, and token or session design. Do not assume that disabling an identity instantly cancels an in-flight call or erases every credential copy already held downstream.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesControls that reduce risk before an incident
- Use least privilege: limit tools, operations, scopes, resources, and downstream rights to what the agent needs.
- Prefer narrow, short-lived credentials: use audience-restricted credentials where supported, and verify their scope and lifetime rather than assuming a protocol provides least privilege automatically.
- Gate high-impact actions: require explicit approval for sensitive operations, and bind approval to the specific operation where the system supports it.
- Assign operational ownership: document an owner or sponsor, approver, purpose, and approved data access for each agent.
- Protect the audit trail: restrict who can view or change logs, keep the agent from controlling its sole record where possible, and redact secrets.
Logging supports detection and investigation; it does not prevent unauthorized actions by itself. Authorization should be enforced at the service boundary, as recommended in OWASP’s agent security guidance and Microsoft’s least-privilege guidance.
How to assess an agent platform’s audit and revocation controls
When reviewing a platform or integration, evaluate these capabilities rather than assuming that a product’s audit screen covers every downstream action.
| Dimension | What to verify |
|---|---|
| Identity attribution | Can each agent have a unique identity, with the human principal preserved when actions are delegated? |
| Permission granularity | Can access be limited by tool, operation, resource, user context, and time, including permissions in downstream services? |
| Audit coverage | Are tool calls, denials, outcomes, approvals, identity changes, and revocation events recorded with IDs that correlate across systems? |
| Log protection and privacy | Who can read or alter records? Can the agent alter its own trail? Are credentials and unnecessary sensitive values excluded? |
| Revocation reach | Can operators disable the identity, invalidate credentials or tokens, remove grants, end sessions, and verify the effect across integrations? |
| Operational ownership | Is there a named owner, an approver for sensitive actions, and a procedure for testing controls? |
This framework reflects OWASP’s guidance on agent controls and Microsoft’s identity and revocation recommendations; it is not a tested ranking of products.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
