SUMMARY: A revocation map records every practical route for withdrawing access, delegated authority, active sessions, integrations, and copied data when a relationship ends.
Most access reviews begin with grants. Who can enter the workspace? Which application can read the calendar? What role can publish a post? This perspective is incomplete because permission is not governed only by how it begins. Durable control depends on how completely it can end.
Removing a user from one interface may leave API tokens, remembered devices, shared recovery addresses, exported files, webhook destinations, and synchronized copies untouched. A visible account can disappear while its delegated authority continues moving through connected systems.
Map the Exit Paths
Primary access: list accounts, roles, keys, and sessions that directly reach the system.
Delegated access: identify applications, service accounts, automations, and people acting on another identity’s authority.
Recovery access: include addresses, devices, support procedures, and administrators that can restore a removed identity.
Data afterlife: record exports, caches, backups, mirrors, and downstream copies that revocation cannot pull back.
Test the Map
Select one noncritical integration and revoke it through the documented path. Confirm that new requests fail, active sessions expire, scheduled jobs stop, and the owner receives a useful record of the change. Then check whether the same authority can be silently recreated by a recovery flow or a higher-level administrator.
The exercise extends recovery authority: the same institution that can restore access may also be able to defeat revocation. Compare the result with permission weather to distinguish a deliberate grant from authority that accumulated through drift.
Record the Residue
A good map does not promise perfect recall. It names what cannot be revoked, who owns the remaining risk, and when residual copies should expire. Review the map after staffing changes, vendor migrations, major incidents, and any redesign of account recovery.
Operator rule: access is not fully governed until its ending is as testable as its beginning.