What does revoking an agent’s access actually do?

It voids that grant and everything beneath it, immediately, for any party that resolves at use time. A counterparty who cached the assertion continues to hold a valid signature until expiry — so revocation is not yet a substitute for a short expiry, and we say so on the page rather than in a footnote.

The artifact that settles it
/trust/revocation · gap dated Q1 2027
↑ delegated authority→ the definition lens · gda.group↓ the verifier