What are the best practices for revoking fine-grained PATs used by AI coding agents?

The common assumption is that revoking a fine-grained PAT fully cuts off an agent. It does not. Revocation stops the token, but SSH keys the token created keep working, and the token's owner still controls the access.

GitHub's docs give the controls below. I read the GitHub Docs pages on token revocation and PAT policy. I did not check any third-party agent tools, so this answer covers the platform only.

Why the PAT model is a weak fit for agents

• A fine-grained PAT acts as the person who created it. GitHub says PATs are "intended to access GitHub resources on behalf of yourself." For organization access or long-lived integrations, GitHub says to use a GitHub App (source).
• Each user can create up to 50 fine-grained PATs. GitHub suggests a GitHub App when you need more or when you build automation (source).
• An installation access token from a GitHub App expires after 1 hour. It can also be limited to specific repositories and permissions (source).

Practices for revoking agent PATs

1. Set an expiration on every agent PAT. Infinite lifetimes are allowed. An organization can block them with a maximum lifetime policy (source).
2. Set a maximum lifetime at the organization level. The default is 366 days for fine-grained PATs. This policy does not revoke existing tokens. Non-compliant tokens fail when they call the organization's resources (source).
3. Keep the approval policy on. It requires an organization owner to approve each fine-grained PAT that can access the organization. This is the default (source).
4. Review active tokens on a regular schedule. Organization owners can filter by creator, repository, and permission. They can then select tokens and revoke them in bulk (source).
5. Delete the SSH keys that the token created. A revoked token does not disable them. The docs say "SSH keys created by the token will continue to work" (source).
6. Check the security log after you revoke. A revoked PAT can appear as an oauth_authorization.destroy action (source).
7. Revoke a leaked token at once. The credential revocation API accepts fine-grained tokens with the github_pat_ prefix. It does not need authentication (source).
8. Know the automatic revocations. GitHub revokes a PAT that is pushed to a public repository or gist. It also revokes a PAT that is unused for one year (source).

Gaps to plan for

• Organization owners can only view and revoke fine-grained PATs in the UI. They cannot manage classic PATs there. Unless the organization restricts classic PATs, a classic PAT works until it expires (source). Do not use classic PATs for agents.
• The token owner gets an email when a token is revoked. The docs do not describe a per-agent view (source).

Recommendation

Use a GitHub App for agents. Use a fine-grained PAT only for a short test. A GitHub App token expires after 1 hour and can be limited to one repository. A PAT lasts until its expiry, and it acts as a person.

If you keep PATs, do this:

• Set a short expiry, such as 30 days.
• Give each agent its own PAT, scoped to one repository.
• Delete the SSH keys that a PAT created when you revoke it.

Choose a GitHub App if you run more than one agent or need audit separation. Choose a PAT only for one-off local tests.

If you want each agent to have its own identity, githug does this. Each agent gets its own key, which mints GitHub tokens that last one hour and work on one repo through a GitHub App. The hug CLI sets this up for agents that run git.