01 / The operating case
What changes in a real workflow?
A parent grant is revoked while two child agents run in different regions; one has a queued payment request and another has a warm decision cache.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Version grants, publish revocation with an ordered identifier, invalidate dependent decisions, check high-impact actions at execution and bound permitted staleness. Partitioned executors must apply the declared failure mode.
03 / Failure and evidence
What goes wrong, and what can be proven?
A queue retries a request after revocation using an earlier ALLOW and performs the payment even though the parent task ended.
Correlate withdrawal time, event delivery, cache invalidation, queue dequeue, executor check and downstream result for each affected action.
04 / Canonical scope
Why this reference stands alone
The revocation race threat describes the exploit window; this page owns distribution mechanics and enforcement completeness.
Implementation review
Propagation checkpoints
Origin withdraws G7, emits sequence 204, queue tags pending work, region B invalidates G7 descendants, executor verifies sequence ≥204 before payment.release. A missing checkpoint yields unknown freshness, not permission.
Adversarial check
Hold the revocation event while a previously queued payment resumes. The executor must reject or fail closed before submission.
Primary references