Revoke and restore access

Cutting a single machine off, without touching the person.

Revoking

Diagnostics → the device row → Revoke access. Its Gateway tokens stop working within roughly 30 seconds — online or not, because the cut is made at the Gateway rather than on the device.

Use it for a lost or stolen laptop, a machine you no longer recognize, or a contractor's device at the end of an engagement.

What the developer sees

Their AI tools stop working. The governed configuration remains in place, so the tools fail closed rather than quietly reverting to talking to the AI provider directly. This is the entire point: a revoked device must not become an ungoverned one.

Restoring

Restore access on the same row puts it back. The device does not need to be re-enrolled.

Revoke or offboard?

• Revoke a device when the person stays and the machine goes.
• Offboard the developer when the person goes. That revokes all their devices, removes their passkeys, and frees their seat — in one action.

Automatic expiry

Policy → Device sessions can retire devices by idle timeout or maximum age without anyone doing anything. Worth setting: it catches the machines nobody remembers to revoke.