01 / The difference
Two facts that must stay separate
An agent credential is compromised while its task grant also has three child delegates.
Treat actor suspension and permission withdrawal as separate operations.
Suspend the credential to stop that actor; revoke the parent grant to stop descendants and alternate credentials.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision boundary
Put the check where it can stop the effect.
Suspend the credential to stop that actor; revoke the parent grant to stop descendants and alternate credentials.
03 / Failure and evidence
What goes wrong, and what can be proven?
Operators suspend one token and assume every delegated child is invalid.
Capture both state transitions, propagation, denied calls and in-flight effects.
04 / Canonical scope
Why this reference stands alone
Authority revocation explains the grant lifecycle; this page compares it with identity suspension.
Technical artifact
Two independent state transitions
agent A credential compromised → suspend identity A parent grant G still has child B → B may remain valid revoke G → B must be denied restoring A identity does not revive revoked G
Run the denial test
Suspend only A and attempt an action through B. Then revoke G and repeat; the second attempt must fail even if B has an unexpired credential.
Primary references