diff --git a/agent/releaseAccess.go b/agent/releaseAccess.go
new file mode 100644
index 00000000..1defd165
--- /dev/null
+++ b/agent/releaseAccess.go
@@ -0,0 +1,29 @@
+package agent
+
+import (
+	"context"
+	"github.com/openziti/zrok/agent/agentGrpc"
+	"github.com/openziti/zrok/agent/proctree"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+func (i *agentGrpcImpl) ReleaseAccess(_ context.Context, req *agentGrpc.ReleaseAccessRequest) (*agentGrpc.ReleaseAccessReply, error) {
+	if acc, found := i.a.accesses[req.FrontendToken]; found {
+		logrus.Infof("stopping access '%v'", acc.frontendToken)
+
+		if err := proctree.StopChild(acc.process); err != nil {
+			logrus.Error(err)
+		}
+
+		if err := proctree.WaitChild(acc.process); err != nil {
+			logrus.Error(err)
+		}
+
+		delete(i.a.accesses, acc.frontendToken)
+		logrus.Infof("released access '%v'", acc.frontendToken)
+	} else {
+		return nil, errors.Errorf("agent has no access with frontend token '%v'", req.FrontendToken)
+	}
+	return nil, nil
+}
diff --git a/cmd/zrok/agentReleaseAccess.go b/cmd/zrok/agentReleaseAccess.go
new file mode 100644
index 00000000..5e0cdaa3
--- /dev/null
+++ b/cmd/zrok/agentReleaseAccess.go
@@ -0,0 +1,55 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"github.com/openziti/zrok/agent/agentClient"
+	"github.com/openziti/zrok/agent/agentGrpc"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/tui"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	agentReleaseCmd.AddCommand(newAgentReleaseAccessCommand().cmd)
+}
+
+type agentReleaseAccessCommand struct {
+	cmd *cobra.Command
+}
+
+func newAgentReleaseAccessCommand() *agentReleaseAccessCommand {
+	cmd := &cobra.Command{
+		Use:   "access <frontendToken>",
+		Short: "Unbind an access from the zrok Agent",
+		Args:  cobra.ExactArgs(1),
+	}
+	command := &agentReleaseAccessCommand{cmd: cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *agentReleaseAccessCommand) run(_ *cobra.Command, args []string) {
+	root, err := environment.LoadRoot()
+	if err != nil {
+		if !panicInstead {
+			tui.Error("unable to load environment", err)
+		}
+		panic(err)
+	}
+
+	client, conn, err := agentClient.NewClient(root)
+	if err != nil {
+		tui.Error("error connecting to agent", err)
+	}
+	defer conn.Close()
+
+	_, err = client.ReleaseAccess(context.Background(), &agentGrpc.ReleaseAccessRequest{
+		FrontendToken: args[0],
+	})
+	if err != nil {
+		tui.Error("error releasing access", err)
+	}
+
+	fmt.Println("success.")
+}