{
  "slug": "revocation-that-propagates",
  "title": "You revoked the agent. Somewhere it is still running.",
  "summary": "Disabling the account reaches the identity provider. OAuth grants, CI tokens and agent minted keys keep working. What chain anchored revocation fixes.",
  "lede": "Revocation is an event in one system and a rumour everywhere else. The identity provider account goes dark in ninety seconds while the OAuth grant still refreshes, the CI token still builds, and the delegation a supplier verified last month still verifies. This is the mechanics of why, what the certificate world already learned the hard way, and how anchoring authority to a root changes the shape of the problem.",
  "date": "2026-09-08",
  "reading_time": "16 min read",
  "category": "Agents",
  "tags": [
    "revocation",
    "offboarding",
    "delegation",
    "agent security",
    "identity lifecycle",
    "kill switch"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Revocation%20Propagation/1200_630/blog.jpg",
  "url": "/blog/revocation-that-propagates.html",
  "wordcount": 3280,
  "related": [
    "kill-switch-design",
    "authority-graph",
    "delegation-tokens-explained"
  ],
  "schema": "Article"
}