Take access away

tovio access revoke <did>

Takes a recipient DID (did:key:<hex>). Removes them from the roster, drops every claim you issued them, and re-seals HEAD's protected content to the reduced roster.

It writes a commit

Unlike a grant, a revoke rotates and re-seals immediately, which means it produces a new commit in your repository. Expect it, and push it — a revocation that never leaves your machine has not taken effect anywhere else.

It is all-or-nothing

If the re-seal fails, the roster change is rolled back, so you never end up with someone half-removed and the content still sealed to them. The audit entry is written only after the whole operation succeeds. Revoking someone who was never enrolled reports that and changes nothing.

Why rotation is part of it

Removing someone from a list stops future grants. It does nothing about the key they already have and the clone already on their laptop. Re-sealing under fresh keys is what actually stops them opening anything new.

What revocation cannot undo

Two things.

• Anything they already decrypted and kept. If a secret was exposed, rotate the secret itself — the credential, the API key — not just the repository access.
• Content below HEAD. The re-seal covers HEAD's protected content. Older commits they already hold remain sealed to the old roster.

Confirm it

tovio access listtovio access check <path> --identity ./peer.identity.pub

Devices rather than people

tovio device listtovio device revoke <did-or-name>tovio device revoke <did-or-name> --yes

For a lost laptop, revoke the device. It accepts the device DID or its unambiguous name, prompts for confirmation unless you pass --yes, and re-seals HEAD to the reduced device set. The person keeps their access from their other machines, and their past signatures stay attributable. An ambiguous name is refused as TVO-IDENT-005 with nothing revoked.

Agent tokens

tovio agent revoke <id>

Revokes a capability token and its descendants.