Revoke Delegation
Overview
Instantly revoke an agent's delegated access, terminating its authority to act on your behalf. Revocation is immediate, cryptographically enforced, and recorded on the immutable provenance ledger.
Why Revoke Delegations?
Think of it like: Canceling a credit card the moment you suspect fraud—instant, irreversible, and auditable.
SDK Examples
REST API Example
DELETE /v1/passport/delegation/{delegationId}
Content-Type: application/json
Authorization: Bearer {
"revokerDid": "did:human:alice-smith",
"reason": "Task completed",
"timestamp": "2026-01-10T12:00:00Z"
}
Response (200 OK):
{
"delegationId": "delegation:human:a1b2c3d4e5f6...",
"status": "revoked",
"revokedAt": "2026-01-10T12:00:00Z",
"revokedBy": "did:human:alice-smith",
"ledgerProof": "0x7b3f9a2c...",
"reason": "Task completed"
}
Use Cases
1. Emergency Revocation
Scenario: An agent is compromised or behaving unexpectedly—immediate termination required.
2. Time-Bound Task Completion
Scenario: An agent completes its assigned task—no need to wait for expiration.
3. Scope Violation Detection
Scenario: An agent attempts an action outside its authorized scope—automatic revocation.
Revocation in Delegation Chains
When you revoke a delegation in a chain, all downstream delegations are automatically revoked.
Provenance Chain After Revocation:
Alice [Human] → Acme Corp [Org] → ~~Senior Agent~~ (REVOKED) → ~~Junior Agent~~ (CASCADED REVOCATION)
All downstream delegations are invalidated to prevent orphaned authority.
Security Considerations
DO:
DON'T:
Provenance & Auditability
Every revocation is permanently recorded on the distributed ledger:
{
"eventType": "delegation_revoked",
"delegationId": "delegation:human:a1b2c3d4e5f6...",
"revokerDid": "did:human:alice-smith",
"revokedAt": "2026-01-10T12:00:00Z",
"reason": "Task completed",
"ledgerSignature": "0x7b3f9a2c...",
"cascadeRevocations": 2 // If delegation chain
}
This creates an immutable audit trail for compliance, security reviews, and forensics.
Security Breach Response
Immediately revoke agent access upon detecting suspicious activity or compromise
Task Completion
Automatically revoke delegation when a specific task or project is finished
Employee Offboarding
Instantly terminate all delegated access when an employee leaves the organization
Agent Rotation
Revoke and re-delegate when upgrading or replacing an agent
DO
Log revocation reasons for audit trails and compliance
Notify affected agents when their access is revoked
Check for delegation chains and revoke sub-delegations automatically
Use revocation lists (CRLs) for offline verification scenarios
DON'T
Delay revocation processing - every second counts in security incidents
Allow revokers without proper authority - verify grantor identity
Skip ledger anchoring - revocations must be immutably recorded
Forget to clean up cached tokens and sessions after revocation
Next Steps
---