Change authority once, and every consumer enforces it at its next read.

An authority withdraws an agent's accreditation. Before the change the agent asks for a role that requires the accreditation, the accreditation is active, and access is granted. Aldercross stops publishing the trust mark for that agent. The mark status answer a consumer holds reaches the end of the window that consumer stated, and the consumer reads policy again. At the next read the role that required the mark is refused. The identity stays, and every other role it holds keeps working.

An authority withdraws the identity itself. Before the change every running instance authenticates as one governed identity. The governed record changes state and the authority stops publishing the statement. Each consumer resolves again, and the chain no longer reaches the anchor that consumer pins. Every instance is refused. The same release under another operator keeps working, through that operator's authority.

An attester stops one running copy. Before the change each instance proves it is a live copy against the attester's signed list. The attester changes that copy's bit on the list it publishes. Each platform reads that list again within the interval it states. That copy is refused and the other copies continue. The identity above them is untouched.

The rows below are the claims this use case carries. Each one links to the artefact that supports it, read on the wire on the date printed beside it. The lifecycle evidence page carries the control surface matrix with the freshness bound for every row.

Publication follows the lifecycle state with one write and one publication step. A live agent read at the moment of the withdrawal answers all four unauthenticated reads with a signed chain to the anchor.

The design requires that a withdrawn accreditation reaches the mark endpoint and the status endpoint within the mint cadence, and the subordinate statement carries the role's policy. An accreditation withdrawn by a scheme officer is recorded in Connect, attributed to the officer's own client and the officer's name. Helena Marsh withdraws Larkspur's agent accreditation in Connect, with a recorded intent, and the scheme's list drops the agent at the next read.

There is more than one thing an organisation may need to stop trusting: one running copy, an identity, a publisher, a key, an accreditation, a token already issued. Each has its own control, and the principle is to act at the layer where the trust changed.

Callum stops one instance of the Batch Reviewer. The attester that vouched for the copy sets one bit on a signed list it publishes, and a platform that reads that list refuses the copy on its next request. The identity above it is untouched.

Imogen withdraws a Connect hosted identity, and the authority stops publishing it. That withdrawal is permanent, which is why it is shown on an identity deployed for the purpose. Tarnbrook withdraws its recognition of Quillon's root, and Quillon's hosted copy stops resolving while Tarnbrook's own copy of the same release keeps serving. A certificate is revoked, and the revocation reaches the published key set, the revocation list and the status responder.

The lifecycle evidence page labels the difference between two paths. Withdrawing an identity Connect hosts is a soft delete and permanent, so the identifier stays retired. Withdrawing an identity the enterprise hosts itself sets its state and stops publication through the catalogue's lifecycle check, and it can be restored in place.

Withdrawing a recognition removes a hop. Everything whose only chain to the anchor ran through that hop stops resolving at the next resolve, and the resolver fails closed, naming the statement it failed to retrieve. Tarnbrook's own copy of the Balance Monitor chains through the Tarnbrook authority directly, so it keeps resolving. That is a blast radius, stated in advance.