Instant revocation
Offboarding increments two epochs. The credential drops from every site access list, the laptop locks and logs off, open exits are rejected, and outstanding tokens die on an epoch mismatch.
Withdrawal is the foundation, not a feature.
Every stronger signal the control plane adds is only safe to trust because the ability to take it away already works, everywhere, in under a second.
A biometric gallery with no working global kill path is worse than a credential-only building. It invites an organisation to trust a stronger signal while leaving it unable to withdraw that trust quickly. So revocation is the load-bearing part of this design, and it runs on something as ordinary as an account being disabled in your directory.
The mechanism is a pair of monotonic counters: one for the principal, one for the device. Incrementing either invalidates every artifact that cited the old value. This is fencing, not expiry, so it does not depend on clocks agreeing across a fleet of edge nodes and laptops.
Two buses carry it, deliberately. A durable, compacted global log is the system of record. A retained per-site channel is the fan-out. If the global log is unreachable, the last retained revocation at each site still applies, and new global revocations queue until it returns.
- Fencing tokens
- Principal epoch and device epoch
- Ordering
- Highest value wins, never the wall clock
- System of record
- Durable compacted global log
- Fan-out
- Retained per-site channel, at-least-once
- Message integrity
- Signed. Unsigned revocations are dropped
- Transport
- Mutually authenticated TLS on both buses
- Off-site devices
- Applied on reconnect or the next heartbeat
- Split brain
- The session authority is the last writer, never the edge
What happens when somebody is offboarded.
One transaction, then a fan-out that touches every plane at once rather than a checklist somebody works through on Monday.
Both epochs increment
The principal epoch and the epochs of every device assigned to them move forward in a single committed transaction. Nothing else is permitted to happen first.
The record is durable before the fan-out
The increment is written to the global log with full acknowledgement, so a crash between commit and delivery cannot lose a revocation.
Sites drop the credential
Each site receives the retained message and removes the identifier from the in-memory access list. The reader shows a denial and the strike ignores that credential from the next tap onward.
Desktops lock and log off
Agents act on the message, or on the epoch mismatch at their next heartbeat. The unlock path is closed, so the credential provider will not present a password field.
Tokens and workflows follow
Outstanding workspace tokens fail on epoch mismatch as caches invalidate. Open gate passes naming that person as carrier are rejected with a reason recorded.
Attestation reflects it
Any third party verifying employment for that principal now receives a revoked status rather than a stale confirmation.
The trail is immutable
The audit log and the asset event history both record the revocation, who triggered it, and what it touched.
Where the half-second goes.
The budget is published so it can be checked rather than believed. Most of it is deliberately reserved as margin.
| Stage | Transport | Allocation |
|---|---|---|
| Ingest to durable log | Authenticated RPC over TLS | 25 ms |
| Log replication | Partition mirroring | 15 ms |
| Site fan-out | Retained message, at-least-once | 120 ms |
| Edge cache invalidation | Local write and memory flush | 40 ms |
| Endpoint execution | Native operating system lock | 50 ms |
| Network margin | Reserved for transit variance | 200 ms |
| Total | Commit to both planes enforcing | 450 ms |
A laptop in a bag at an airport cannot be locked in half a second, and no honest system claims otherwise. What it can do is refuse every new grant while the device is stale, and enforce the moment it reconnects. Where a confirmation matters, a distant site can raise a service desk ticket that somebody has to close.
The properties that make it trustworthy.
Triggers
A directory disable, an HR leaver record, a security team action, or a reported lost card.
Forward only
Epochs never decrease, so a replayed old message cannot restore access.
Signed only
Unsigned or badly signed revocations are dropped, not retried.
Broker outage
The last retained revocation continues to apply at every site.
Lost card
Increments the device epoch without disturbing the principal's other access.
Re-hire
A new epoch and a fresh enrollment, never the reinstatement of an old credential.
Related
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.