Comparison
Revocation vs. token expiry
Token-based systems end authority by expiry: until then the token is valid, whatever happens. Mandates end authority by revocation: the status is checked live on every verification, and a revocation takes effect without a grace period — even in the middle of a token's lifetime.
| Dimension | Active revocation (mandate) | Passive token expiry |
|---|---|---|
| Effect of withdrawal | Effective from the next check, next verify → MD-201 | Only at expiry or after invalidation latency |
| Compromised agent | Kill switch stops it from the next check | Damage possible until expiry/rotation |
| Offline trust | Not allowed — status endpoint with no-store | Common — token valid until exp |
| Price for it | Online duty when checking | Works offline |
Verdict
For mandates the trade-off is clear: the online duty is the price for a revocation that actually works. Fail-closed is the only defensible direction for authority — better to refuse a verification than to accept a revoked mandate.