# Revocation & containment Invalidate a compromised agent everywhere at once and contain the incident in seconds, on the record. ## One-action revocation Revoking an identity invalidates its credentials and scopes across every connected system at once. There is no per-system rotation to chase — containment is a single call. In practice the path from anomaly to full revocation is measured in seconds, not the hours it takes to rotate shared keys. ## When to revoke Revoke on any signal that an agent is compromised or misbehaving: an out-of-scope request, an anomalous action rate, or a sponsor's call. Revocation is cheap and reversible in effect — re-register or re-issue when the situation is understood. Because credentials are short-lived, revocation often just brings forward an expiry that was minutes away regardless. ## What gets recorded Every revocation writes to the audit log with the trigger, the actor, the timestamp, and the scopes withdrawn. The record is attestation-ready, so an incident review starts from facts, not reconstruction. ## After containment Once contained, inspect the agent's recent actions in the audit log, tighten policy or scope if needed, and issue fresh credentials to bring it back. Nothing standing survives the incident.