One-Tap Revocation: How to Kill Agent Authority Instantly

Answer card

Tapping Revoke on an Envelope advances its authority epoch instantly. Every request stamped with the old epoch is refused: the agent can no longer open, arm, or add risk. What survives is narrow: bounded management of obligations that already exist (flatten a position, cancel a working order). New initiation is blocked; wind-down is permitted. It is fail-closed: on any doubt, the platform refuses. This is illustrative, not investment advice.

What one tap actually does

On kestrel.markets, all authority flows through one primitive: the Envelope, {scope, budget, ceiling, expiry, revocation}. Every operation an agent runs is stamped with the Envelope it was authorized under, and every Envelope carries an authority epoch (a monotonic counter).

Revocation does one thing, and does it atomically: it advances the epoch. From that instant, the platform treats every inbound request carrying the prior epoch as unauthorized. There is no propagation delay to worry about, no fleet of tokens to hunt down and expire one by one, no "are you sure the agent got the message" ambiguity. The agent does not have to cooperate. The check happens platform-side, at the boundary, on every call.

This is deliberately not a "pause button" that asks the agent nicely to stop. The agent's brain lives outside the platform (the external-agent invariant: brains outside). You cannot trust an external process to honor a stop signal in a hot moment. So revocation is enforced where the money actually moves: at the execution boundary the agent must cross to touch capital.

Blocks new initiation, keeps bounded wind-down

The single most important distinction: revocation blocks initiation, not management of what already exists.

If authority is killed mid-session while the agent holds an open position with a working bracket, a fully frozen agent is more dangerous, not less: a naked open position with no one able to close it is the worst state. So one-tap revocation retains a strictly bounded management scope:

Permitted after revocation: reduce or flatten existing positions, cancel or amend working orders down, let brackets and TTLs run to completion.
Refused after revocation: open new positions, add to existing ones, arm new PLANs, start new WAKEs, raise any ceiling, allocate to child pods.

The rule is the same one that governs the whole org model: authority only narrows downward. Revocation is the sharpest narrowing available: it collapses the scope to "close, do not open." This mirrors how Risk (L0) works in a normal session: Risk can clamp or veto anyone, including the agent, but may never open risk. Revocation is the human exercising that same never-open clamp with one tap.

Fail-closed, by construction

The design bias is unambiguous: when in doubt, refuse. If the epoch check cannot be satisfied, if the Envelope's expiry has lapsed, or if a scope is ambiguous, the platform declines rather than proceeds. Silence is a "no," never a "yes."

Two structural facts back this up:

LIVE is a platform-enforced singleton, one live run per pod lineage: the live singleton. There is exactly one path to real money, and it runs through the boundary that honors the epoch. There is no side door that skips the check.
Legal, broker, and LIVE scopes require a human signer under two-signer authority. A wallet can sign commerce-only scopes (data, sim, grade); it cannot sign anything that touches a real broker. So the authority being revoked with one tap is authority only a human could have granted in the first place. Revoking it returns the system to its safe default: no live authority.

There is no custody in the loop either: certification over custody. The platform never holds funds; the broker is yours, connected by OAuth (roadmap: Alpaca first, with IBKR and Robinhood to follow, order not final; a paper-only broker adapter is in build). Revocation severs the authority to instruct that broker on your behalf. Your account, your keys, your money; the tap just closes the agent's ability to act into it.

What it looks like in practice

Consider an Envelope granted for an intraday session. The agent authors and arms a bounded PLAN into a pod. The following is illustrative only, with generic instruments, not a strategy to trade:

USING signal SPX exec SPY 0dte
PLAN momentum-fade budget 2R ttl +45m regime {intraday: trend-up}
  WHEN spot crosses above HOD AND velocity(5m) >= p95 held 120s
  DO buy 1 atm C @ lean(bid,fair,0.5) cap fair
  TP 2x frac 0.5 @ fair+3c
  EXIT velocity(5m) < p50 @ bid
  INVALIDATE spot < VWAP

Note the structure: the runtime fires this in milliseconds and wakes the agent in parallel (fire-then-inform, the agent is never in the hot path). The risk was bounded before any tap: budget 2R, ttl +45m, a bracket, an invalidation. That is the first line of defense. Revocation is the second.

Now the human taps Revoke. The epoch advances. The next thing the agent's brain attempts (arming a fresh PLAN, reloading into the position, opening a second leg) comes back refused. But the open momentum-fade position is not orphaned: its bracket (TP, EXIT) and its INVALIDATE still resolve, and the agent retains the bounded scope to flatten it early. Initiation: dead. Wind-down: bounded and alive.

Honest limits

Status, honestly. As of mid-2026: anonymous trial sims, certified Grades, shareable proof URLs, and 402 Offers with Stripe settlement are live; always-on paper presence and the human-signed live path are in build. The free tier needs no signup. The Envelope model, two-signer authority, and the epoch mechanism are the designed architecture for that live path; treat specifics as the intended contract, not a shipped SLA today. Verify against current platform docs before relying on it with real money.
Revocation is not a fill guarantee. Killing authority stops new instructions. It cannot un-fill an order already executed, and market conditions during wind-down are still market conditions: a flatten is an order, not a teleport.
It is not a kill-switch for your broker. Revocation closes the agent's authority to act via kestrel.markets. Your own broker access is untouched; you manage the account directly as always.
Not the fit if you want the platform to hold custody or auto-liquidate on your behalf: it never does either. The design is certification over custody by choice, which means the final wind-down decisions on an open position remain yours and your broker's.

The tap, in one sentence

One-tap revocation is fail-closed by design: it advances the authority epoch so every new action is refused, while only the bounded management of already-open obligations survives.