The cleanest event in a token incident may be the least conclusive one: “revocation command accepted.” It timestamps an administrative action, not the moment access ends.
A responder can watch the issuer stop minting tokens, the key rotation complete, and the resource policy update—each in a different console—while an application-managed session survives. Every panel is technically telling the truth. Together, they are staging a premature curtain call.
Containment therefore needs an end-to-end clock. Start at command acceptance and keep testing the compromised authority across verifiers, resources, application sessions, grants, secrets, and certificates. The last successful access reveals the gap; the first correlated denial across every material path closes it. One mapped high-impact application is enough to expose missing evidence and unclear ownership without trying to fix all of cloud identity at once.
Read the full analysis.