Revoking an Agent's Access Mid-Task: Token Lifetime Design for Agentic Systems

You cannot revoke a self-contained token. You can only outlive it. We built an agentic system, revoked access at every second of a 40-minute task, and measured what kept working: a one-hour token serves 719 more requests, a four-hop chain drains 73% slower than a single service, and 128 of 209 IETF agent drafts that discuss revocation cite no mechanism for it.