01 / The operating case
What changes in a real workflow?
A grant is revoked in region A while a child agent in region B attempts to rotate a production secret using a cached ALLOW.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Assign monotonic grant versions, replicate revocation with observed sequence numbers, and require the executor to prove it has reached the necessary version before a high-impact effect. If partitioned, deny or enter a narrower predefined mode.
03 / Failure and evidence
What goes wrong, and what can be proven?
Region B evaluates its stale local copy and records ALLOW even though the parent grant no longer exists at the authority origin.
Preserve region, grant and policy versions, last seen revocation sequence, decision time and downstream effect so a split-brain result can be reconstructed.
04 / Canonical scope
Why this reference stands alone
Revocation propagation describes the distribution path; this page owns the consistency contract when independent regional decision points disagree.
Implementation review
Regional version comparison
Region A revokes grant at version 8. Region B has version 7. Secret-rotation executor requires version ≥8 or a current authority proof; with only version 7, the request is denied pending convergence.
Adversarial check
Partition region B after a cached ALLOW, revoke in A and attempt rotation in B. Record the stale version and confirm no protected effect escapes.
Primary references