> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rotascale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revocation

> Withdrawing authority, what happens to work already in flight, and the interval nobody rehearses.

Revocation sets a grant's status and stamps who did it and when. It is a state
change on the record rather than a delete, because a grant that was valid and
then was not is a fact about a period of time.

```http theme={"system"}
POST /v1/grants/{grant_id}/revoke
```

## It reaches down the tree

Revoking a parent revokes its children. Without that, a delegated pipeline keeps
running on borrowed permission until the child's own expiry, which in most
implementations is the actual behaviour and is almost never what anybody
intended.

See [Delegation](/concepts/delegation).

## The interval, which is the part that gets skipped

Between the revoke and the last child stopping there is a window. Actions may
have been permitted in it.

> "We revoked at 14:02" is not an answer to "what did it do at 14:03".

The record answers it. Every decision carries the grant it drew on and the
moment it was made, so the set of actions permitted inside that window is a
query rather than an argument.

<Tip>
  **Rehearse this once, in a controlled window, with somebody watching.** Start a
  delegated pipeline, revoke the parent mid-flight, and see what the child does
  next. Whatever happens is what will happen on the bad day, and finding out then
  is considerably more expensive.
</Tip>

## Revocation is not the only stop

Three different things stop an agent and they are worth telling apart:

|                 | What it does                        | When to reach for it                                 |
| --------------- | ----------------------------------- | ---------------------------------------------------- |
| **Revoke**      | Withdraws the authority permanently | The authority was wrong, or the agent is compromised |
| **Drop a rung** | Moves `enforce` back to `observe`   | The control is too aggressive, the agent is fine     |
| **Expiry**      | The grant runs out on its own       | Always. This is why `ttl_hours` has a default        |

Reaching for revocation when the answer was a rung is how teams end up with an
outage instead of a tuning exercise.

## Certification can be revoked too

Separately, and it means something different: not "this authority is withdrawn"
but "this agent should not be given authority again". See
[Certification](/concepts/certification).