Glossary · OT cybersecurity
Credential revocation
Also known as: Token revocation, Access revocation, Revoking access
German: Widerruf von Zugangsdaten
Credential revocation is the act of invalidating a credential — a password, API key, access token, certificate or session — before it would expire, so that a user, service, device or AI agent can no longer use it to access a system.
- OT security
In one sentence
Credential revocation invalidates keys, tokens, certificates or sessions early, so a person, device or AI agent loses access at once.
Example
After a coding agent leaked a cloud key into a public log, the team revokes the key, rotates the dependent secrets and checks the cloud audit log for its use.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: The containment ladder · Code repositories, CI/CD and cloudStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Containing an AI agent: pause, revoke, isolate, shut downHow do you stop an AI agent that has crossed its boundary — without making things worse, and without confusing it with stopping a machine?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
How it applies
- Revocation needs a list: You can only revoke quickly what you know exists. Keep an inventory of the credentials each agent, service and device uses.
- Short lifetimes help: Short-lived access tokens limit the window in which a stolen or misused credential works, but long-lived refresh tokens and API keys still need active revocation (for OAuth 2.0, RFC 7009).
- For AI agents: With a separate agent identity, revoking the agent's access doesn't lock out the people it worked for — a precise containment step.
- IoT and OT: Devices often hold certificates or keys for years. Revoking them needs a process in the device management and, in OT, a plan for what the affected component does when it loses its connection.