The order matters
Revoke the widest access first, then work inward: device, token, key. That way a compromise cannot jump from one layer to the next while you are still cleaning up.
Lost or stolen device
- Revoke the device in the console — it stops claiming tasks and its token stops working.
- Check the audit history for what the device did in its last hours.
- If the device ever held a raw key locally, rotate that key — a stolen laptop plus a key is the worst combination.
A teammate leaves
- Remove their member access — the mechanism from team key sharing.
- Rotate any key that touched their personal machine, not just the shared vault.
- Record it: the audit chain should show when access ended and who ended it.
A misbehaving agent
An agent that ignores policy does not always need a key change — first tighten the policy itself: secure mode, narrower capabilities, and a lower spend cap. Revoke only what you must; a revoked-but-needed access is how shadow workarounds start.
Make revocation routine
The test: can you name, in one sentence, how to cut off any device, member, or key in under a minute? If not, that is the gap — the vault design exists precisely so the answer is always yes.