# Revoke and restore access

Cutting a single machine off, without touching the person.

## Revoking

**Diagnostics → the device row → Revoke access.** Its Gateway tokens stop working within
roughly 30 seconds — online or not, because the cut is made at the Gateway rather than on
the device.

Use it for a lost or stolen laptop, a machine you no longer recognize, or a contractor's
device at the end of an engagement.

## What the developer sees

Their AI tools stop working. The governed configuration remains in place, so the tools
**fail closed** rather than quietly reverting to talking to the AI provider directly. This
is the entire point: a revoked device must not become an ungoverned one.

## Restoring

**Restore access** on the same row puts it back. The device does not need to be
re-enrolled.

## Revoke or offboard?

- **Revoke a device** when the person stays and the machine goes.
- **Offboard the developer** when the person goes. That revokes *all* their devices,
  removes their passkeys, and frees their seat — in one action.

## Automatic expiry

**Policy → Device sessions** can retire devices by idle timeout or maximum age without
anyone doing anything. Worth setting: it catches the machines nobody remembers to revoke.

<!-- shot:diag-revoke -->
![Revoke access sits on every device row — the Gateway notices within about thirty seconds.](https://docs.sentilai.com/uploads/images/gallery/2026-08/KMwdiag-revoke.png)
*Revoke access sits on every device row — the Gateway notices within about thirty seconds.*