Governance Deep Dive: Designing Revocation That Actually Revokes

Revoking a grant is only real when cached tokens, running sessions, and queued work all honor it, and most revocation designs stop at the first of those.

Deleting the grant row is the ceremonial part of revocation. The operational part is hunting down every cache, session, and queued task still carrying a copy of the old yes.

Where revocations go to die

• Token caches that outlive the grant by their TTL.
• Long-running sessions that checked permissions once at start.
• Queued work authorized at enqueue time, executing much later.

Use the AuthGuardian, security docs, and architecture guide to chase the revocation through every layer that cached the grant.