Multiplayer Collaborative Canvas  ·  View 22 of 23  ·  Assurance

Admission and Revocation

How a capability is bound, and how it is taken away while the file is still open.

Editable source SVG draw.io All views
Stakeholder Client Entra ID Admission Sharing service Session host 1. opens a shared link 2. sign in, OIDC 3. token, 60 min 4. connect: document, token 5. verify token and tenant 6. resolve role 7. commenter, link scope 8. bind capability 9. connected: comment only 10. grant revoked 11. detached in under 10 s Identity — Admission, Capability and Revocation Mid-Session The capability is bound once at admission and re-evaluated on every grant change — messages 10 and 11 are the path that makes revocation a platform guarantee rather than a page reload. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • The capability is resolved once at admission and bound to the connection, so the hot path never asks the sharing service a question (ADR-14).
  • Every grant change pushes to the sessions it affects: messages 10 and 11 are the revocation path, and the requirement is ≤ 10 s from grant change to a detached or downgraded client.
  • During a control-plane outage, existing sessions continue on their cached capability for at most 5 minutes and new admissions fail closed — availability for the people already working, nothing for the people who were not.

Numbers

  • Token lifetime ≤ 60 minutes, renewed on the live connection; revocation effective ≤ 10 s.
  • Capability cache grace 5 minutes. Both stated assumptions.

Risks

  • The 5-minute grace window is a deliberate hole: a revocation issued during a control-plane outage can be up to 5 minutes late. The alternative — failing open or detaching every session — costs more than it buys.
◀  Security Trust Zones All views Failure Classes  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-1022-admission-and-authorisation