Revocation Closure

Origin domain

Synthesized (in-house)

Subdomain

authority lifecycle and recall → Synthesized (in-house)

Also from

Computer Security, Law & Governance, Organizational & Management Science, Certification

Aliases

Recall Closure, Bounded Revocability, Complete Revocation

Related primes

Authority, Delegation of Authority, Coverage / Reachability, Boundedness, Propagation

Core Idea

Revocation Closure is the lifecycle property in which an issuer retains a bounded-time path to invalidate every active manifestation and downstream derivative of a grant. The audit target is the grant's actual effect set—every place where it can authorize, certify, permit, or bind—not merely the entries recorded in the issuer's registry. Closure fails when an unknown copy, delegated branch, stale verifier, offline site, or derived permission continues to act after the issuer has withdrawn the original grant.

The abstraction is stronger than having a revocation procedure. A button, blacklist, recall notice, or formal power is insufficient if some live effect cannot receive, recognize, or enforce it within the promised horizon.

Broad Use

• Computer security: deactivate credentials, sessions, certificates, and delegated tokens across caches, replicas, and offline verifiers.
• Organizations: recall delegated decision rights and every subdelegation created under them.
• Law and licensing: withdraw a license, commission, or authorization wherever relying parties treat it as valid.
• Consent and data governance: stop future uses authorized by withdrawn consent, including downstream processors.
• Physical access: re-key or otherwise invalidate every copy of a key or badge without finding each carrier individually.

Clarity

The prime separates formal revocation from effective revocation. “The issuer revoked it” describes an authoritative act; closure asks whether that act reached the full live effect set within a stated time. It also separates visibility from control: an issuer may know a copy exists but lack a path to invalidate it, or possess a global invalidation mechanism even when individual copies cannot be enumerated.

Manages Complexity

Revocation becomes a graph audit. Enumerate the issued grant, its copies and derivatives, the sites that recognize them, the available invalidation paths, and the maximum propagation time. Any live target with no bounded path is a closure gap. This unifies credentials, certificates, physical keys, licenses, and delegated roles without treating their local recall procedures as unrelated.

Abstract Reasoning

Define the required target set as every place where the grant can still produce an authorized effect. For each target, ask whether an issuer-triggered path causes rejection within deadline T. Adding an untracked derivative enlarges the target set; adding a reliable invalidation path improves coverage; extending offline acceptance may violate the time bound even if eventual contact is certain.

Knowledge Transfer

The roles transfer unchanged: issuer, grant, active manifestation, derivative, relying site, revocation trigger, invalidation path, and deadline. Re-keyable locks, certificate status checks, license registries, and organizational recall orders use different mechanisms but answer the same question: can the issuer make every live effect stop counting, everywhere it currently counts, within bounded time?

Example

An API key is copied into several services and images. Deleting its record from one vault does not revoke the copies. If every authorization check consults a central status service, one status change may close the graph without locating the copies; if offline services continue accepting the key indefinitely, closure fails even though the issuer's registry says “revoked.”

Relationships to Other Abstractions

Current abstraction Revocation Closure Prime

Parents (3) — more general patterns this builds on

• Revocation Closure presupposes Authority Prime

  Revocation Closure presupposes Authority because some recognized issuer must have standing to create and later invalidate the grant.

• Revocation Closure is part of Boundedness Prime

  A finite revocation horizon is a strict constituent because eventual withdrawal with no upper time bound does not provide operational closure.

• Revocation Closure is part of Coverage / Reachability Prime

  Complete reachability over the grant's actual live effect set is a strict constituent of Revocation Closure.

Children (1) — more specific cases that build on this

• Secret Sprawl Domain-specific presupposes Revocation Closure

  Secret Sprawl is the credential-copy failure in which the actual live effect set outruns the issuer's invalidation paths and Revocation Closure collapses.

Hierarchy paths (4) — routes to 4 parentless roots

• Revocation Closure → Authority

Show alternative paths (3)

Not to Be Confused With

• Revocation act: issuing a withdrawal is one event; closure is the global property that every active effect obeys it.
• Coverage / Reachability: supplies the all-target reachability constituent but not the authority, invalidation semantics, or time bound.
• Delegation of Authority: creates and distributes a grant; Revocation Closure governs whether its effects can later be withdrawn everywhere.
• Containment: prevents spread across a perimeter; a grant may remain contained yet lose closure through untracked internal copies.
• Reversibility: undoing an action's consequences differs from invalidating continuing authority for future effects.

Notes

Authored when Secret Sprawl exposed a missing cross-domain parent. Queued for house-style harmonization and citation verification.