Revoke a token right now

tovio agent revoke <token-id>

Revokes the token and every token delegated from it.

What stops

Further operations under that token are refused with TVO-TOKEN-003. Delegated descendants fail on their next call, when the chain is re-verified. Because validity and scope are settled before any seal, an in-flight operation is refused rather than half-applied.

A revoked token is also permanently spent: agent renew refuses it (TVO-TOKEN-007). Issue a fresh one rather than trying to revive it.

What does not stop

Work the agent already committed. It is on the agent's lane and stays there — revoking the token does not retract commits.

tovio agent abandon agent/<name>

Tombstones the agent's lane if you want the work gone as well. This takes the lane path, not the agent name — either the plain agent/<name> lane or a deeper one such as agent/<name>/work, whichever the agent actually used.

If the agent read something it should not have

Revocation is future-facing. If the agent decrypted a secret that was within its clearance, rotate that secret. Then narrow the clearance, or protect the path, so the next token cannot reach it.

Working out what it touched

tovio audit show --token <token-id>tovio log --entity agent --task-id <task-id>tovio audit graph task:<task-id>

The audit chain records actions taken under the token including refused ones, which is often the more interesting half. audit graph assembles the same material as a derivation graph if you would rather see the shape than the list.

Revoking is cheap; leaving one open is not

Revoke a token when its task is finished rather than letting it expire. An expired token and a revoked token both stop working, but only one of them tells the next reader that you meant it.