Revocation

This page specifies what happens when consent narrows: what a revocation cuts at once, what it leaves, the deadlines each side meets, how released outputs are treated, and how a platform acknowledges that it complied.

​

Scope

A revocation has a scope and targets, and takes effect at effective_at.

​

What the license server does

TLP-RVK-1. From effective_at, a license server MUST deny every new check and session under the targets with license_revoked, and MUST issue no new authorization or session token under them. TLP-RVK-2. At effective_at, a license server MUST resolve every open escalation under the targets to deny with license_revoked, MUST deny every held output under them with license_revoked and send generation.denied for it, so it can no longer be released, and MUST deny any generation submitted later against a check under them. TLP-RVK-3. A license server MUST terminate every live session under the targets, pushing session.terminated with the revocation’s ID on the session stream and as an event. It SHOULD do so within 2 seconds of effective_at at the 95th percentile. TLP-RVK-4. A license server MUST list the revocation in its revocation feed from effective_at, readable oldest first after a cursor, and MUST send revocation.created. It SHOULD send the event within 5 seconds of effective_at at the 95th percentile. TLP-RVK-5. A revocation MUST state its required_actions from stop_generation, purge_cached_decisions, delete_provider_copies, cease_distribution and withdraw_outputs; every copy held at a provider that must be deleted, in provider_copies; and an acknowledge_by 24 hours after effective_at. TLP-RVK-6. A license server MUST take the post_revocation policy from the license’s signed terms, MUST apply withdraw only when the revocation is for cause (for_cause: true), and MUST update the live status of every affected receipt at effective_at.

​

Post-revocation policies

Released outputs are governed by the policy the talent signed into the license. Unreleased work is void under every policy: pending checks, open escalations and held outputs are denied.

​

What a conformant platform does

TLP-RVK-7. A platform MUST receive revocation.created events. A platform that caches checks, authorizations or decisions MUST also read the revocation feed at least every 60 seconds; the feed is the source of truth and events are the fast path. TLP-RVK-8. On learning of a revocation, a platform MUST start no new generation under the targets and MUST discard its cached checks and authorizations for them. It MUST NOT pass a token under the targets to a generation tool after that point. TLP-RVK-9. A platform MUST stop output within one second of session.terminated, and MUST NOT renew or restart the session. TLP-RVK-10. A platform MUST delete each copy listed in provider_copies, at its provider, before acknowledge_by. TLP-RVK-11. A platform MUST apply the revocation’s post_revocation policy to the outputs it released and still distributes or hosts. TLP-RVK-12. Before acknowledge_by, a platform MUST acknowledge every action in required_actions except withdraw_outputs, listing every deleted copy with its deleted_at. When required_actions includes withdraw_outputs, the platform MUST acknowledge it in a later acknowledgement, before post_revocation.withdraw_by. It MUST NOT list an action it has not completed. Each acknowledgement adds to the revocation’s acknowledgements, is an attestation, and is shown on the talent’s record. TLP-RVK-13. A license server MUST keep a revocation pending_acknowledgement until every required action is acknowledged, then mark it acknowledged. It MUST mark the revocation overdue when either deadline passes first: acknowledge_by with an action other than withdraw_outputs unacknowledged, or post_revocation.withdraw_by with withdraw_outputs unacknowledged. It then sends revocation.overdue and shows the revocation as overdue on the talent’s record.

​

Tokens already issued

A generation tool verifies tokens offline and cannot learn of a revocation. Exposure after effective_at is therefore bounded by token lifetimes: an authorization token expires at most 15 minutes after issue and a session token at most 5 minutes after issue. A platform closes the window sooner by not passing tokens after it learns (TLP-RVK-8). A generation submitted afterwards is denied (TLP-RVK-2), so its output is never delivered.

​

Suspension

A suspension pauses a license, such as during a dispute. It is not a revocation, creates no revocation object and needs no acknowledgement. TLP-RVK-14. While a license is suspended, a license server MUST deny checks under it with license_suspended, terminate its sessions and refuse their renewal. Held outputs stay held, and released outputs are unaffected. Checks are decided again normally after license.resumed. TLP-RVK-15. A platform that caches decisions MUST discard them for a license when it receives license.suspended.

​

What revocation leaves

A receipt signed before effective_at stays valid evidence that the decision was made under a license in force. Its live status, not its signature, says what use is permitted now (Receipts).

​

Related