Access Revocation

Access revocation removes previously allowed access. It can follow departure, reassignment, expiry, or a policy change. The change must reach the paths that actually authorize requests.

Removing membership may leave usable credentials

A support agent leaves shop A. Removing the agent from a group may not immediately invalidate a token, cached decision, or shared file link. Identify how each path learns of the change and the delay during which old access can persist.

Set an intended revocation window and verify behavior at the service boundary. A model instruction cannot revoke a credential.

Test reuse as well as a fresh login

Check a new request, an existing session, a direct API call, and a cached answer. Background jobs may hold separate service credentials and need their own rules. Record unresolved paths and limit access while they are corrected.

Revocation prevents future authorized use within the controlled system; it cannot make a recipient forget information already seen or automatically erase an exported copy.

Reference: OWASP Authorization.