Effective revocation must terminate credentials, task execution, descendants, callbacks, and pending side effects.
Why this question matters
Long-running agent work may span asynchronous A2A tasks and MCP operations. By the time a principal revokes access, a child agent may already hold derived credentials or a queue may contain an approved action waiting to execute.
A complete revocation model therefore needs a task graph. Systems must identify descendants and external commitments, distinguish reversible from irreversible operations, and provide evidence of what was stopped versus what had already completed.
Signals worth observing
- A cancelled parent continues receiving child artifacts.
- Callbacks remain active after credential revocation.
- Queued side effects execute under a stale approval state.
Practical control direction
- Bind every child task and callback to a revocable parent identifier.
- Check current authority immediately before irreversible execution.
- Return a revocation report covering descendants and residual effects.
AgentCollusion lensThe ability to pause an entire coordination graph is a core Guardian Agent capability.Sources and further reading
- A2A Protocol specification
- Model Context Protocol authorization specification
- NIST NCCoE: Software and AI agent identity and authorization
Next field note: Non-Repudiation Needs More Than a Signature
