Use case 06

When something changes. Access adapts.

Revoke the one thing that changed. Every consumer applies it at its next read, inside a window it states in advance, and everything else keeps running.

Run the trust check The evidence behind this

Choose what changed

1Something changesPick what changed.

2Trust updatesThe party that owns it publishes.

Instance stopped

The attester publishes it. That copy's bit changes on its signed list.

Key revoked

Connect's certificate service publishes it. The published key set drops it, and the revocation list carries it.

Accreditation withdrawn

The issuing authority publishes it. Its list drops it, and the role's policy leaves the statement.

Agent withdrawn

The authority publishes it. The governed record changes state and the statement stops being published.

Recognition withdrawn

The authority above that root publishes it. It stops publishing its statement about the root.

3Access adaptsEach consumer applies it at its next read.

0 sPublished
Its signed list expires within 60 s
Next requestRefuse
A token already issued expires within 300 s

If a platform cannot read the list, it reuses its last copy for up to 300 s

Recognition A recognised root the recognition , stays

Identity An agent one governed identity , stays

Its artefacts A certificate the credential , out of scope An accreditation the role it grants , out of scope

Running copies this copy , gone every other copy , stays

Another chain The same release via another hop , stays

0 sPublished
Each consumer resolves again within 300 s
Next requestRefuse
A token already issued expires within 300 s

Recognition A recognised root the recognition , stays

Identity An agent one governed identity , stays

Its artefacts A certificate the credential , gone An accreditation the role it grants , out of scope

Running copies this copy , stays every other copy , stays

Another chain The same release via another hop , stays

0 sPublished
Each consumer resolves again within 300 s
Next requestReduce or Refuse where a consumer requires the mark
A token already issued expires within 300 s

Not observed on this tenant The status endpoint keeps answering active, so a consumer that checks only the mark keeps admitting. Read the authority's list.

Recognition A recognised root the recognition , stays

Identity An agent one governed identity , stays

Its artefacts A certificate the credential , out of scope An accreditation the role it grants , gone

Running copies this copy , stays every other copy , stays

Another chain The same release via another hop , stays

0 sPublished
Each consumer resolves again within 300 s
Next requestRefuse
A token already issued expires within 300 s

Recognition A recognised root the recognition , stays

Identity An agent one governed identity , gone

Its artefacts A certificate the credential , out of scope An accreditation the role it grants , out of scope

Running copies this copy , gone every other copy , gone

Another chain The same release via another hop , stays

0 sPublished
Each consumer resolves again within 300 s
Next requestRefuse
A token already issued expires within 300 s

Recognition A recognised root the recognition , gone

Identity An agent one governed identity , gone

Its artefacts A certificate the credential , out of scope An accreditation the role it grants , out of scope

Running copies this copy , gone every other copy , gone

Another chain The same release via another hop , stays

Stayskeeps its authority
Goneloses its authority
Out of scopea separate object with its own control

Instancestop Deployment evidence

Keeps running Every other instance of the same agent, and the identity above them.

Certificaterevoke Deployment evidence

Keeps running The identity the credential authenticated, on a new key.

Trust markwithdrawNot observed on this tenant

Keeps running The identity, and consumers that admit it on other grounds.

AgentwithdrawObserved

Keeps running The same release under another operator, through that operator's authority.

Publisherwithdraw Deployment evidence

Keeps running Every identity whose chain to the anchor runs through another hop.

Act at the layer that changed

Five scopes, from one running copy to a publisher's recognition.
Stop one copy

The other copies and the identity above them keep running.
A window stated in advance

Each consumer declares how long it holds an answer.
Everything else keeps running

What the change does not reach keeps its authority.

Watch

When something changes

2 min 6 s Open the film file

Read the evidence behind this

Which control surface carries each change in your estate today, and what freshness bound would you accept?

Ninety minutes, on the shape of your estate: which systems resolve first, which anchor each pins, and which key each party holds.

Book a working session

Next use case Your own assistant