API Key and Token Service  ·  View 14 of 22  ·  Act 5 · Runtime

Revocation Propagation

Accept, order, publish, apply, prove — and what happens when the last step cannot be proved.

Editable source SVG draw.io All views
Accept Revoke request console, API or policy Durable append multi-region quorum Acknowledge only after quorum Order Monotonic sequence never rewound Tenant epoch bump bulk in one write Publish Push channel Pub/Sub · p50 ≤ 2 s Poll fallback 5 s, self-healing Heartbeat proves the feed lives Apply Overlay update additive, idempotent Per-point ack sequence high-water Prove Revocation canary issue → revoke → re-verify Propagation SLO p99 ≤ 10 s · ceiling 60 s Fail safely Staleness ceiling 120 s without a poll Fail closed write and admin scopes refused Read-only continues per tenant policy one message, N keys catch-up silence past the ceiling Revocation Propagation — accepted here, dead everywhere Interface / broker Data store Decision point Queue / topic Security / platform Application we own Risk / gap Opportunity synchronous event / async failure / alternate A revocation is acknowledged only after a durable multi-region write; everything downstream can be replayed, the acknowledgement cannot be taken back. Per-point acknowledgements feed the canary, which is how the p99 on this page is measured rather than asserted. v 1.0 · owner Security Platform Architecture · date 2026-09

The acknowledgement rule

  • A revocation is acknowledged only after a durable multi-region write. Everything after that point is replayable; the acknowledgement itself is not retractable by a replication catch-up, a cache repopulation or a restore.
  • Bulk revocation is a tenant epoch bump: one ordered write and one message, whether it kills one key or a hundred thousand.

Push, poll, or filter

  • Push is fast and fails silently; poll is self-healing and adds a floor to propagation time; a probabilistic filter distributes everywhere and can deny a valid credential. The set assumes push with a 5-second poll fallback and a heartbeat, which buys the push latency without the silent failure.
  • This is Core Architecture Question 2 in the requirement, and it stays open: the filter option becomes attractive above roughly ten thousand verification points.

Numbers

  • p50 ≤ 2 s, p99 ≤ 10 s, ceiling 60 s. 100,000 credentials revoked and propagated within 5 minutes. All invented; all measured in production by the canary rather than asserted.
◀  Critical Flow — issue, then rotate All views Leak to Containment  ▶
Solution Architecture v1.0 · Google Cloud with open-source edge components · Security Platform Architecture · 2026-0914-revocation-propagation