Skip to main content
Revocation sets a grant’s status and stamps who did it and when. It is a state change on the record rather than a delete, because a grant that was valid and then was not is a fact about a period of time.

​
It reaches down the tree

Revoking a parent revokes its children. Without that, a delegated pipeline keeps running on borrowed permission until the child’s own expiry, which in most implementations is the actual behaviour and is almost never what anybody intended. See Delegation.

​
The interval, which is the part that gets skipped

Between the revoke and the last child stopping there is a window. Actions may have been permitted in it.
“We revoked at 14:02” is not an answer to “what did it do at 14:03”.
The record answers it. Every decision carries the grant it drew on and the moment it was made, so the set of actions permitted inside that window is a query rather than an argument.
Rehearse this once, in a controlled window, with somebody watching. Start a delegated pipeline, revoke the parent mid-flight, and see what the child does next. Whatever happens is what will happen on the bad day, and finding out then is considerably more expensive.

​
Revocation is not the only stop

Three different things stop an agent and they are worth telling apart: Reaching for revocation when the answer was a rung is how teams end up with an outage instead of a tuning exercise.

​
Certification can be revoked too

Separately, and it means something different: not “this authority is withdrawn” but “this agent should not be given authority again”. See Certification.