A revocation path is the defined process for removing access or disabling an account, token, API key, service account, or integration. In security terms, it is the “off switch” for an identity or connection: who can trigger it, how fast it happens, and what systems must be updated so the access truly stops.
Revocation paths matter because blocked users or expired permissions are not enough if old credentials, OAuth grants, or connected apps still work. Attackers often exploit forgotten tokens, stale integrations, or over-permissioned automation to keep access after an account is reset. Defenders reduce this risk by maintaining inventories, using least privilege, rotating secrets, logging changes, and testing that revocation actually breaks the connection. In AI-agent environments, a clear revocation path is essential for shutting down a dangerous agent quickly when its behavior changes or its permissions are no longer trusted.