Control objective
After an authorised revocation decision, the affected device must no longer perform protected actions. Other authorised devices should continue without unnecessary global interruption.
Start and end point
The clock starts at confirmed administrative action and ends only when API, realtime, refresh, file access and reauthentication consistently reject the old state. A disappearing interface is insufficient.
Attack surface
Test the existing access token, rotating refresh token, open WebSocket, cached file URL, push subscription and parallel device history. Each path needs an expected revocation effect.
Metrics
Core measures are maximum rather than only mean revocation latency, blocked old requests, error rate on unaffected devices, residual offline data and audit evidence quality.
Negative tests
Tests repeat the old session after network isolation, clock skew, process restart and concurrent token rotation. Robust revocation remains effective even when the device did not initially receive the server decision.
Acceptance
Each organisation sets its targets. At minimum, no tested path remains authorised after the documented endpoint, and actor, target, time and outcome are traceable.