API Key and Token Service · View 18 of 22 · Act 6 · Operations
Proof, not assertion
- The revocation canary issues a credential, verifies it, revokes it and re-verifies it, continuously, in production. Propagation p99 is a measurement from that loop, not a number in this document.
- It runs from a separate project that this platform's operators cannot deploy to, because a platform cannot be the only judge of whether it can still revoke.
Silence detection
- A stopped revocation feed, a scanner integration that quietly died, a verification volume that dropped — each looks like health to a monitor that only watches for errors. Each gets its own alarm on absence.
- The heartbeat is the load-bearing one: its silence is what starts the 120-second staleness clock.
Assumptions
- Verification telemetry sampled at 1% on success and 100% on denial, so observability cost scales with problems rather than with traffic.
- Durable-store reads on the verification path are counted and alerted on as an exception, not budgeted as a steady-state cost.
