Glossary
Revocation
Revocation is what turns 'this credential is no longer good' into a fact the rest of the system actually respects, before whatever expiry was originally set. It matters most exactly when things have gone wrong: a device is lost, an employee's access needs to end today rather than at its next scheduled review, a key is suspected of being copied.
The hard part of revocation is rarely the decision to revoke — it is making sure every part of a system that was relying on the old state finds out fast enough. A revocation that takes hours to propagate, because some component caches credentials or trusts a stale list, is a revocation in name only for the length of that delay.