Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
T25 · Revocation invalidates open sessions and saved links
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software |
| Layer / kind | API · E2E · worker |
| Priority | P0 |
| Gates | A06, A09 |
| Build step | Step-03-Policy-Pipeline-and-Isolation-Harness |
| Decisions | Q07, Q09 |
Given
B user has an open tab, session, copied link and queued assigned-question alert.
When
Remove B membership; then fetch, mutate, reload, open link and run the queued job.
Then / oracle
Every future authorisation boundary denies access despite stale session claims; authorised replay is checked before idempotent result return. Suppress unsent alert if removal precedes final eligibility check. Already viewed/downloaded/delivered information cannot be recalled; do not imply secure erasure from recipients.
Evidence required
Session/API/link denial; provider-call spy not invoked; no leaked private canary.
Decision dependency (verbatim)
Q07/Q09: effective removal, in-flight send boundary and retention. Participants receive limitation disclosure under T03.
Source: TDD rev 1.3 (PDF); machine-readable in 10-Sources/tdd-bundle/. Back to Scenario-Index · Traceability-Matrix · integration dependencies in Dependency-and-Regression-Table.