Revoke and restore access
Cutting a single machine off, without touching the person.
Revoking
Diagnostics → the device row → Revoke access. Its Gateway tokens stop working within roughly 30 seconds — online or not, because the cut is made at the Gateway rather than on the device.
Use it for a lost or stolen laptop, a machine you no longer recognize, or a contractor's device at the end of an engagement.
What the developer sees
Their AI tools stop working. The governed configuration remains in place, so the tools fail closed rather than quietly reverting to talking to the AI provider directly. This is the entire point: a revoked device must not become an ungoverned one.
Restoring
Restore access on the same row puts it back. The device does not need to be re-enrolled.
Revoke or offboard?
- Revoke a device when the person stays and the machine goes.
- Offboard the developer when the person goes. That revokes all their devices, removes their passkeys, and frees their seat — in one action.
Automatic expiry
Policy → Device sessions can retire devices by idle timeout or maximum age without anyone doing anything. Worth setting: it catches the machines nobody remembers to revoke.
Revoke access sits on every device row — the Gateway notices within about thirty seconds.