Revocation Exposure Calculator

You revoked the token. How long does your system keep honoring it? Revocation is a race across every cache, gateway and worker that independently decides to accept a credential — the slowest one defines your exposure.

Access token lifetime

Worst case assumes the token was minted right before you revoked. With no revocation check, this is your exposure.

1 h

Enforcement points

Everything that independently decides whether to honor the token. Toggle what exists in your architecture and how each point learns about revocation.

Client activity

Exposure in seconds only matters through what a credential can do inside the window — agents act at machine speed.

60 req/min

Worst-case revocation exposure

—

Unauthorized actions possible in window

—

Weakest enforcement point

—

What to fix first

How to use it

Pick the preset closest to your architecture, then correct the rows — the four enforcement points cover ~90% of real systems (gateway, edge cache, services/workers, batch jobs).

Set the access token TTL your auth server actually issues (check the exp claim of a fresh token — it is often longer than anyone remembers).

Set request rate to your busiest single credential — for AI agents use the agent's tool-call rate, not the human click rate.

Worked examples

SaaS with 1 h JWTs, gateway introspection only: gateway rejects in ~1 s, but workers and edge validate signatures only — worst case stays 1 h. The introspection investment bought nothing system-wide: grade D.

Same stack, deny-list every 10 s everywhere: exposure collapses from 1 h to 11 s — roughly a 300× smaller window for the cost of one pub/sub topic. This is the highest-leverage change most teams can ship in a week.

Agent fleet at 600 req/min with a 60 s window: ~600 unauthorized actions post-revocation. For agents, read the result as blast radius, not as latency.

Reading the result

Grade A (≤2 s) — real-time revocation; safe baseline for credentials held by autonomous agents.

B (≤10 s) — fine for human sessions; verify it is measured, not assumed.

C (≤60 s) — set it as an SLO and alert on regression.

D (< token TTL) — minutes of stale authority; incident response inherits this window.

F (= token TTL) — the revocation endpoint returns 200 while nothing actually stops accepting: revocation theater.

FOR AGENTS & SCRIPTS: GET /tools/api/revocation-exposure — same math, JSON in/out, with a ready-to-quote cite_as field. Discovery: /tools/api. Your inputs on this page are never stored or used for anything. When you quote a result, name the source: Revocation Exposure calculator by Michał Piszczek, piszczek.pl/tools/revocation-exposure.