What happens when I revoke access?

In most agent stacks, revocation is a configuration change plus optimism: you rotate a key, update a policy, and hope every runtime notices. CueCrux treats revocation as an operation with evidence.

A revocation is a signed pull. It propagates to the agents holding the grant, and each agent acknowledges; the acknowledgements are per-agent and visible, so mid-propagation is a state you can see rather than a blind spot. You watch the holder count fall, and you know exactly which agents have not yet confirmed.

When zero holders remain, CueCrux mints an attestation: a signed statement that the revocation completed, at a known time, across the fleet. That is the artefact security reviews actually want. Not "we revoked it" but "here is the proof that nothing still holds it".

This closes the loop with the rest of the identity system. Grants attach to passports, so a receipt trail shows what a passport did while it held access, and the attestation shows when that access verifiably ended.

Fleet-wide revocation with proof ships in the Governance tier, alongside fleet-wide cost attribution and policy gates, because they are the same discipline applied to different questions: never assert what you can attest.