Revocation

Pick the narrowest control that stops the problem. All of them stop new authority at once on the hosted gateway and API; customer-hosted gateways learn of them on their next bundle (within the 300-second freshness window, see Relay and status freshness).

You want to stop	Use	Who can
One key or workload identity	Revoke the credential	agent.write on the tenant
One agent's access to one service	Revoke the grant	grant.write on the tenant
Everything one agent does	Suspend the agent	agent.write on the tenant
An agent, key, grant, tenant, service or project across the org, now	Open an incident with emergency denies	incident.respond on the org (Control)

Revoke a credential

POST /v1/agents/{agent_id}/credentials/{credential_id}/revoke
content-type: application/json

{ "reason": "Key file copied to an unmanaged laptop" }

• The credential becomes revoked and every access token issued with it is revoked immediately. The next call with such a token fails with 401 invalid_token (credential_revoked).
• The agent ID, its grants and its pending actions are untouched. Bind a new key (see Registering and admitting agents) and the agent continues; it may resume its own approved actions with the new key.
• A resume of an action that was submitted with the revoked credential is refused: the action becomes revoked (credential_revoked). The agent must submit again with its new credential.
• For a certificate-backed credential Axiom also asks the CA to revoke the certificate by serial. This is best effort: a CA outage never blocks revoking the credential in Axiom, which is what stops new authority; the failure is logged for follow-up. (In SCM mock mode the revocation goes to the local development CA.)

Revoke a grant

POST /v1/grants/{grant_id}/revoke
content-type: application/json

{ "reason": "Customer ended the pilot" }

The grant and every descendant (delegated child grants) are revoked; the response lists the revoked IDs. A child grant is also unusable if any ancestor is revoked, suspended or expired, even before the tree walk reaches it.

Suspend an agent

POST /v1/agents/{agent_id}/status
content-type: application/json

{ "status": "suspended", "reason": "Investigating unexpected refunds" }

All of the agent's tokens are revoked; token requests are refused (agent_suspended); submits and status reads with an old token fail. Reactivate with "status": "active" and a reason. "retired" is permanent.

Emergency deny (Control)

An incident (POST /v1/orgs/{oid}/incidents, console Incidents at /control/orgs/:oid/incidents) publishes emergency denies against agents, credentials, grants, tenants, services or projects, optionally suspending org-owned agents and revoking grants. Agent and tenant targets also deny their grants, so delegates holding descendant grants are blocked. An identity outside your org cannot be suspended; it is contained by denying its grants on your services. Denies are lifted only by releasing the incident with a recorded reason, and release never reactivates agents. See the safe release runbook.

What happens to work in flight

Action state when you revoke	What happens
pending_approval	Stays pending; approvers may still decide. When the agent resumes, the recheck closes it as revoked (or denied). Nothing executes.
approved	The resume recheck closes it as revoked (grant_revoked, agent_suspended, credential_revoked or emergency_deny).
executing, outcome_unknown	Already dispatched under the old authority. Revocation is recorded separately; the operation is still reconciled with the provider by operation key, and the receipt records what the provider confirmed.
succeeded, failed	Unchanged. Receipts stay verifiable: retired and revoked keys remain published, marked with their status.

The incident detail screen lists in-flight actions and previously dispatched work separately from the local block, so you can see what revocation could and could not stop. A provider that must undo a committed write does so in its own system; Axiom never sends a compensating request.