What does revocation do?
After approval is revoked, expires, or reaches its usage limit, the server refuses further retrievals. It checks current permissions each time it delivers data. An agent’s previously saved status is not enough.
What cannot be revoked?
You cannot make a recipient forget a password or erase a key they already copied. Revoking access in Palladin does not change the password at the destination service either. If a password or API key has leaked, change it with its issuer.
Changing keys
Rotation means replacing an old key with a new one. A new Vault Key (VK) protects future data only after entry keys and data are appropriately protected again and access is provided to the remaining recipients. Material copied before the change remains associated with the old keys.
Devices without internet
An offline device cannot immediately receive a revocation notice. The server blocks further retrievals, but does not erase data or keys already saved on the device.