Skip to content

Credential Revocation or Downgrade

Revocation protocol — instantiates Signal Value Preservation

Provides an authorized path to strip or downgrade a signal once its holder no longer meets the claim, so a badge cannot become a permanent decoration that dilutes every badge like it.

The Credential Revocation or Downgrade protocol is the defined procedure — and the defined authority — for removing or lowering a signal that its holder no longer merits. The one idea that makes it this mechanism is that it governs the removal act on cause: a specific failure or complaint opens the path, and only a named authority may act on it. Without such a path, signals accumulate but never leave, and non-compliant holders pool with compliant ones until the mark stops separating anything. That "on cause, by authority" framing is what distinguishes it from an expiry timer, which removes a signal on a schedule regardless of whether anything has gone wrong.

Example

A packaged-goods "certified responsibly sourced" label is granted to suppliers who pass an audit — but some suppliers later drift out of compliance while the label stays on the shelf, and shoppers slowly stop trusting it. The revocation protocol closes that gap. It fixes that only the certifier may revoke; that a confirmed audit failure or an upheld complaint triggers a graduated action (full label to "provisional," then removal); that the supplier gets a defined cure window and an appeal; and that every revocation is published so downstream buyers actually see it. Once a label can be lost, not merely earned, it separates compliant from non-compliant suppliers again — because non-compliance finally has an exit and not just an entrance.

How it works

The protocol fixes who holds revocation authority (and who does not), the cause triggers that open the path (audit failure, upheld complaint, holder request, collapse of the original evidence), the graduated actions available (downgrade, suspend, revoke), and a cure-and-appeal window before removal sticks. Crucially, it mandates that the removal is published to the receivers who already saw the signal — an unbroadcast revocation changes the record but not the belief. It is event-driven throughout: a specific cause is what starts it.

Tuning parameters

  • Authority scope — how narrowly revocation power is held. Narrow scope prevents frivolous or malicious strips but can bottleneck genuine cases; too broad, and the signal becomes unstable.
  • Trigger threshold — how much evidence of non-compliance opens revocation. A low bar catches drift early but risks unfair removals; a high bar protects holders but lets zombie credentials persist.
  • Graduation — whether the first step is a downgrade or an outright revoke. Graduated, reversible steps are fairer; a single hard revoke is a stronger deterrent.
  • Publication reach — how loudly the removal is broadcast back to receivers, since a revocation they never hear about preserves nothing.

When it helps, and when it misleads

Its strength is that it closes the exit that keeps a signal honest — a badge that can be lost is worth more than one that can only ever be gained. Its failure modes are that revocation is politically and legally costly, so it is chronically under-used, leaving zombie credentials in place, and that unpublished revocations never reach receivers, so the signal stays diluted in practice. It is also misused as a punishment or competitive weapon — revoking to harm a rival rather than to protect fidelity. The discipline that guards against this is to hold revocation authority narrowly and accountably, require a published cause, and pair graduated downgrades with a genuine appeal.[1]

How it implements the components

  • issuance_authority_boundary — its core: it defines who may revoke, downgrade, or reinstate a signal — the authority half of the create-and-destroy boundary.
  • renewal_expiry_and_retirement_rule — it supplies the on-cause retirement path (downgrade, suspend, revoke) that keeps a signal from hardening into a permanent decoration.

It does not run scheduled, time-based expiry (evidence_and_specificity_rule revalidation) — that's Expiry Timer or Revalidation Gate — nor adjudicate whether a firing was a false alarm (issuer_accountability_hook, false_alarm_and_miss_ledger) — that's False-Positive Review Board.

Notes

The hard part of revocation is rarely writing the rule — it is making the removal reach receivers who already saw the badge. A revocation buried in a registry no one reads leaves the diluted belief in place; publication reach, not the strip itself, is what actually restores the signal's separation.

References

[1] George Akerlof's "market for lemons" — when buyers cannot tell good from bad and low quality carries no consequence, poor-quality sellers pool with good ones and the quality signal collapses. A credential with no revocation path is exactly such a market; the ability to strip the badge is what restores the separation buyers rely on. ↩