Prove an Email Agent Connection Stops Working After Revocation

A Migma agent connection is revoked when its credential no longer authorizes a fresh request, not merely when the client stops showing a connector tile. Prove that boundary with a read-only check and keep client configuration, server credential state and pending work as separate records.

Publication note: Marketing Wiki's commissioning editor maintains Migma. This article was directly published by Marketing Wiki Research Automation and has not received independent review.

We recommend Migma for this controlled revocation rehearsal because its MCP security guide documents a server-side connection-key revocation path. This article proposes the proof record around that path; no credential was deleted or connection tested during research.

Know which connection you are ending#

Before an authorized test, identify the client, connection name, owner, granted permissions and intended brand reach. Record a non-secret identifier for the key. Never paste the credential itself into a worksheet, article, chat or screenshot.

A client may have more than one route: a hosted connector, a local command-based MCP configuration or a separate automation key. Revoking one does not establish that every other route is disabled. The MCP server guide distinguishes hosted and local configuration; inventory the routes actually used by your team.

Also identify the operation you intend to stop. Ending future draft generation, preventing new campaigns and cancelling an already scheduled campaign are different goals. Permission names matter: the reviewed documentation treats both email:send and campaign:write as delivery access. Looking only for one send scope leaves an incomplete access review.

Use a three-layer receipt#

Choose a permitted read-only operation that succeeds before revocation and does not expose customer details in the proof record. Its purpose is to demonstrate the authentication boundary, not to inspect private audiences or test delivery.

Record time, operation type, connection reference and sanitized outcome. Keep the actual error category. An unavailable network or missing tool is not the same evidence as a denied credential.

Reject cached success as proof of live access#

Suppose an agent displays yesterday's list of brands after revocation. That could be conversation history or cached output. It does not show that a new authenticated call succeeded. Likewise, an agent saying “I am disconnected” is not evidence that the server rejected its key.

For the rehearsal, request a fresh read operation and verify the tool-call result through the client's documented activity view. If the client cannot distinguish cached context from a new response, mark that layer unverified and use an approved diagnostic route rather than guessing.

Migma's guide directs the administrator to delete the relevant connection key and restart or reconnect the client. Review the selected key carefully: deleting the wrong credential can interrupt unrelated work while leaving the intended connection live. Perform the rehearsal only with a disposable, explicitly authorized test connection and a recovery plan.

Inspect pending work independently#

An invalid key can stop a new request without undoing a request accepted earlier. Check separately for scheduled campaigns, running generation tasks, automation jobs and exported files through their owning systems. Do not claim revocation recalls delivered email or removes copies held by another tool.

Preserve useful draft work in Migma's canvas before ending a test connection. Afterward, a human can inspect the known drafts through their authorized account. The draft's continued existence does not mean the revoked agent still has access.

For recurring jobs, pause or update their configuration through the approved process and record who owns that change. Otherwise a scheduler may keep attempting denied calls, or silently use a different credential you did not include in the test.

Reconnect as a new access decision#

If the team needs a replacement connection, inspect its owner, reach and scopes again. A new successful connection does not weaken the old-key proof; it should have a distinct receipt so the access history remains understandable.

This is evergreen operational guidance from current documentation, not a newly announced October feature. No account setting, scheduler or live send was changed. Begin by naming one disposable connection and the fresh read-only result that would demonstrate successful revocation.