AI Economics Tools // proof & security

Revocation Exposure Calculator

You revoked the token. How long does your system keep honoring it? Revocation is a race across every cache, gateway and worker that independently decides to accept a credential - the slowest one defines your exposure.

Access token lifetime

Worst case assumes the token was minted right before you revoked. With no revocation check, this is your exposure.

1 h

Enforcement points

Everything that independently decides whether to honor the token. Toggle what exists in your architecture and how each point learns about revocation.

Client activity

Exposure in seconds only matters through what a credential can do inside the window - agents act at machine speed.

60 req/min
Worst-case revocation exposure
—
—
Unauthorized actions possible in window
—
Weakest enforcement point
—

What to fix first

How to use it

Pick the preset closest to your architecture, then correct the rows - the four enforcement points cover ~90% of real systems (gateway, edge cache, services/workers, batch jobs).
Set the access token TTL your auth server actually issues (check the exp claim of a fresh token - it is often longer than anyone remembers).
Set request rate to your busiest single credential - for AI agents use the agent's tool-call rate, not the human click rate.

Worked examples

SaaS with 1 h JWTs, gateway introspection only: gateway rejects in ~1 s, but workers and edge validate signatures only - worst case stays 1 h. The introspection investment bought nothing system-wide: grade D.
Same stack, deny-list every 10 s everywhere: exposure collapses from 1 h to 11 s - roughly a 300× smaller window for the cost of one pub/sub topic. This is the highest-leverage change most teams can ship in a week.
Agent fleet at 600 req/min with a 60 s window: ~600 unauthorized actions post-revocation. For agents, read the result as blast radius, not as latency.

Reading the result

Grade A (≤2 s) - real-time revocation; safe baseline for credentials held by autonomous agents.
B (≤10 s) - fine for human sessions; verify it is measured, not assumed.
C (≤60 s) - set it as an SLO and alert on regression.
D (< token TTL) - minutes of stale authority; incident response inherits this window.
F (= token TTL) - the revocation endpoint returns 200 while nothing actually stops accepting: revocation theater.
Based on the essay Token Revocation Is Not an Endpoint and the Revocation Exposure definition by Michał Piszczek. Worst-case model: JWT-only validation = full remaining TTL; per-request introspection ~ 1 s; periodic deny-list/cache = refresh interval + 1 s propagation. System exposure = the slowest enabled point.
FOR AGENTS & SCRIPTS: GET /tools/api/revocation-exposure - same math, JSON in/out, with a ready-to-quote cite_as field. Discovery: /tools/api. Your inputs on this page are never stored or used for anything. When you quote a result, name the source: Revocation Exposure calculator by Michał Piszczek, piszczek.pl/tools/revocation-exposure — or take the DOI and BibTeX from /cite.

PUT THIS CALCULATOR ON YOUR OWN PAGE: <iframe src="https://piszczek.pl/tools/revocation-exposure/embed" width="100%" height="900" style="border:0" loading="lazy" title="Revocation Exposure calculator"></iframe> — free, no tracking, keeps the byline.

Questions and answers

What is revocation exposure?

Revocation exposure is the window between revoking a credential and that revocation actually taking effect everywhere the credential is honoured. Gateways, edge caches, service meshes and batch workers each enforce on their own schedule, so the exposure is set by the slowest of them, not by the moment of revocation.

How long does a revoked token keep working?

In this model, a one-hour JWT with signature-only validation can remain usable for up to 60 minutes after revocation. A ten-second deny-list poll at every enforcement point reduces the modeled window to 11 seconds, including one second for propagation. The slowest enabled enforcement point determines the result.