When Revocation Does Not End Access
The old credential fails. What can still replace it? I examine repair order, replacement credentials and pending issuance through controlled HTTP experiments, a conditional graph argument, and documented Equifax, Exchange and MOVEit cases.
Open question: What is the smallest additional observation that distinguishes a successful revocation from durable loss of access when replacement credentials or accepted work remain possible?
