The permission was revoked and the session lived on

# Self-authored for the EML case corpus (no external origin). A revocation
# propagates in forty milliseconds and the offboarding target is fifteen
# minutes. How long the access lasts is computed below.
#
# The authorization service is fast and correct. A role removal is written to
# the store, invalidates its own read caches, and every subsequent authorization
# decision reflects it within forty milliseconds. It is audited, the audit is
# complete, and the fifteen-minute offboarding target is met by a factor of
# twenty thousand.
#
# The subsequent authorization decisions are the ones that ASK. A session token
# carries its claims signed at issue, and a service that trusts the token does
# not ask — that is what the token is for, and it is why the system scales.
#
# Tokens last eight hours.

214 => revocations_per_month
8 => token_lifetime_hours
40 => propagation_milliseconds
900 => offboarding_target_seconds
0 => propagation_failures

int(token_lifetime_hours / 2) => mean_remaining_hours
revocations_per_month * mean_remaining_hours => person_hours_of_access_after_revocation
int(offboarding_target_seconds * 1000 / propagation_milliseconds) => target_over_propagation
mean_remaining_hours * 3600 => mean_remaining_seconds
int(mean_remaining_seconds / offboarding_target_seconds) => access_over_target

"revocations per month        : " + str(revocations_per_month) ^0
"propagation, ms              : " + str(propagation_milliseconds) ^0
"offboarding target, seconds  : " + str(offboarding_target_seconds) ^0
"target over propagation      : " + str(target_over_propagation) + " times" ^0
"" ^0
"token lifetime, hours        : " + str(token_lifetime_hours) ^0
"mean remaining at revocation : " + str(mean_remaining_hours) + " hours" ^0
"access after revocation, over the target : " + str(access_over_target) + " times" ^0
"person-hours of access after revocation, monthly : " + str(person_hours_of_access_after_revocation) ^0
"" ^0

# ---- what the revocation verified ----

"the authorization service" ^0
"  role removal written to the store : immediately" ^0
"  its own read caches invalidated   : yes" ^0
"  subsequent decisions reflect it   : within " + str(propagation_milliseconds) + " ms" ^0
"  audited                           : yes, completely" ^0
"  propagation failures              : " + str(propagation_failures) ^0
"  offboarding target met by         : " + str(target_over_propagation) + " times" ^0
"  verdict                           : REVOKED" ^0
"" ^0
"  the number is real and the service is not the problem" ^0
"" ^0

# ---- who asks ----

"the two kinds of decision" ^0
"  a service that calls the authorization service : sees" ^0
"    the revocation in " + str(propagation_milliseconds) + " ms" ^0
"  a service that validates the token's signature : sees" ^0
"    the claims as they were at issue" ^0
"  which is more common : the second, deliberately" ^0
"  why : it is what makes the system scale" ^0
"" ^0
"  the design is not an oversight; the token exists so that" ^0
"  most decisions do not need a call" ^0
"" ^0

# ---- what the offboarding checklist records ----

# The checklist has one line for access removal and it is ticked when the
# revocation returns. The measurement it records is the one the service
# reports, which is correct and is about the service.
"the checklist" ^0
"  line               : access removed" ^0
"  ticked when        : the revocation returns" ^0
"  time recorded      : " + str(propagation_milliseconds) + " ms" ^0
"  time until the person cannot act : up to " + str(token_lifetime_hours) + " hours" ^0
"  a line for the second : none" ^0
"" ^0

# ---- null control ----

# The same service, with tokens carrying a short lifetime and a refresh that
# re-asks, so a revocation is felt within one refresh interval.
5 => nc_token_lifetime_minutes
int(nc_token_lifetime_minutes * 60 / 2) => nc_mean_remaining_seconds
0 => nc_access_beyond_the_target

"null control - short tokens with a refresh that re-asks" ^0
"  propagation, ms      : " + str(propagation_milliseconds) + ", unchanged" ^0
"  mean remaining access, seconds : " + str(nc_mean_remaining_seconds) ^0
"  access beyond the offboarding target : " + str(nc_access_beyond_the_target) ^0
"  the revocation did not get faster; the population of" ^0
"  decisions that ask it grew" ^0
"" ^0

# ---- the rule ----

"what an instant revocation guarantees" ^0
"  every decision that asks gets the new answer : exactly" ^0
"  every decision gets the new answer           : not" ^0
"    addressed; a signed claim is a decision cached in the" ^0
"    holder's pocket, and the point of it is not to ask" ^0
"" ^0
"revocation latency is the propagation time plus the lifetime" ^0
"of whatever was issued before it; the first is measured on a" ^0
"dashboard and the second is a configuration value nobody" ^0
"reads as a security parameter" ^0
"" ^0

"Revocation propagates in " + str(propagation_milliseconds) + " ms with " + str(propagation_failures) + " failures, audited, meeting a " + str(offboarding_target_seconds) ^0
"second offboarding target by " + str(target_over_propagation) + " times. Most decisions validate a signed token" ^0
"instead of asking, which is the design and is why it scales, so a revoked" ^0
"person keeps acting for a mean of " + str(mean_remaining_hours) + " hours - " + str(access_over_target) + " times the target - and" ^0
str(revocations_per_month) + " revocations a month leave " + str(person_hours_of_access_after_revocation) + " person-hours of access behind them." ^0

revocations_per_month = 214
token_lifetime_hours = 8
propagation_milliseconds = 40
offboarding_target_seconds = 900
propagation_failures = 0
mean_remaining_hours = int(token_lifetime_hours / 2)
person_hours_of_access_after_revocation = revocations_per_month * mean_remaining_hours
target_over_propagation = int(offboarding_target_seconds * 1000 / propagation_milliseconds)
mean_remaining_seconds = mean_remaining_hours * 3600
access_over_target = int(mean_remaining_seconds / offboarding_target_seconds)
print("revocations per month        : " + str(revocations_per_month))
print("propagation, ms              : " + str(propagation_milliseconds))
print("offboarding target, seconds  : " + str(offboarding_target_seconds))
print("target over propagation      : " + str(target_over_propagation) + " times")
print("")
print("token lifetime, hours        : " + str(token_lifetime_hours))
print("mean remaining at revocation : " + str(mean_remaining_hours) + " hours")
print("access after revocation, over the target : " + str(access_over_target) + " times")
print("person-hours of access after revocation, monthly : " + str(person_hours_of_access_after_revocation))
print("")
print("the authorization service")
print("  role removal written to the store : immediately")
print("  its own read caches invalidated   : yes")
print("  subsequent decisions reflect it   : within " + str(propagation_milliseconds) + " ms")
print("  audited                           : yes, completely")
print("  propagation failures              : " + str(propagation_failures))
print("  offboarding target met by         : " + str(target_over_propagation) + " times")
print("  verdict                           : REVOKED")
print("")
print("  the number is real and the service is not the problem")
print("")
print("the two kinds of decision")
print("  a service that calls the authorization service : sees")
print("    the revocation in " + str(propagation_milliseconds) + " ms")
print("  a service that validates the token's signature : sees")
print("    the claims as they were at issue")
print("  which is more common : the second, deliberately")
print("  why : it is what makes the system scale")
print("")
print("  the design is not an oversight; the token exists so that")
print("  most decisions do not need a call")
print("")
print("the checklist")
print("  line               : access removed")
print("  ticked when        : the revocation returns")
print("  time recorded      : " + str(propagation_milliseconds) + " ms")
print("  time until the person cannot act : up to " + str(token_lifetime_hours) + " hours")
print("  a line for the second : none")
print("")
nc_token_lifetime_minutes = 5
nc_mean_remaining_seconds = int(nc_token_lifetime_minutes * 60 / 2)
nc_access_beyond_the_target = 0
print("null control - short tokens with a refresh that re-asks")
print("  propagation, ms      : " + str(propagation_milliseconds) + ", unchanged")
print("  mean remaining access, seconds : " + str(nc_mean_remaining_seconds))
print("  access beyond the offboarding target : " + str(nc_access_beyond_the_target))
print("  the revocation did not get faster; the population of")
print("  decisions that ask it grew")
print("")
print("what an instant revocation guarantees")
print("  every decision that asks gets the new answer : exactly")
print("  every decision gets the new answer           : not")
print("    addressed; a signed claim is a decision cached in the")
print("    holder's pocket, and the point of it is not to ask")
print("")
print("revocation latency is the propagation time plus the lifetime")
print("of whatever was issued before it; the first is measured on a")
print("dashboard and the second is a configuration value nobody")
print("reads as a security parameter")
print("")
print("Revocation propagates in " + str(propagation_milliseconds) + " ms with " + str(propagation_failures) + " failures, audited, meeting a " + str(offboarding_target_seconds))
print("second offboarding target by " + str(target_over_propagation) + " times. Most decisions validate a signed token")
print("instead of asking, which is the design and is why it scales, so a revoked")
print("person keeps acting for a mean of " + str(mean_remaining_hours) + " hours - " + str(access_over_target) + " times the target - and")
print(str(revocations_per_month) + " revocations a month leave " + str(person_hours_of_access_after_revocation) + " person-hours of access behind them.")

revocations per month        : 214
propagation, ms              : 40
offboarding target, seconds  : 900
target over propagation      : 22500 times

token lifetime, hours        : 8
mean remaining at revocation : 4 hours
access after revocation, over the target : 16 times
person-hours of access after revocation, monthly : 856

the authorization service
  role removal written to the store : immediately
  its own read caches invalidated   : yes
  subsequent decisions reflect it   : within 40 ms
  audited                           : yes, completely
  propagation failures              : 0
  offboarding target met by         : 22500 times
  verdict                           : REVOKED

  the number is real and the service is not the problem

the two kinds of decision
  a service that calls the authorization service : sees
    the revocation in 40 ms
  a service that validates the token's signature : sees
    the claims as they were at issue
  which is more common : the second, deliberately
  why : it is what makes the system scale

  the design is not an oversight; the token exists so that
  most decisions do not need a call

the checklist
  line               : access removed
  ticked when        : the revocation returns
  time recorded      : 40 ms
  time until the person cannot act : up to 8 hours
  a line for the second : none

null control - short tokens with a refresh that re-asks
  propagation, ms      : 40, unchanged
  mean remaining access, seconds : 150
  access beyond the offboarding target : 0
  the revocation did not get faster; the population of
  decisions that ask it grew

what an instant revocation guarantees
  every decision that asks gets the new answer : exactly
  every decision gets the new answer           : not
    addressed; a signed claim is a decision cached in the
    holder's pocket, and the point of it is not to ask

revocation latency is the propagation time plus the lifetime
of whatever was issued before it; the first is measured on a
dashboard and the second is a configuration value nobody
reads as a security parameter

Revocation propagates in 40 ms with 0 failures, audited, meeting a 900
second offboarding target by 22500 times. Most decisions validate a signed token
instead of asking, which is the design and is why it scales, so a revoked
person keeps acting for a mean of 4 hours - 16 times the target - and
214 revocations a month leave 856 person-hours of access behind them.

Trace event types