MAQPNADocs

AgentRevocation

AgentRevocation (maqpna.com/v1alpha1): every field, type, default and validation rule, generated from the CRD schema.

AgentRevocation revokes agent tokens at the gateway within seconds and optionally suspends or terminates the matching sessions. Revocations are namespaced (they only match sessions of their namespace) except in the gateway namespace, where they apply cluster-wide.

At a glance#

Property Value
API version maqpna.com/v1alpha1
Kind AgentRevocation
Scope Namespaced
Plural agentrevocations
Short names arev
Categories maqpna
Status subresource yes 
kubectl get agentrevocations -A
kubectl get arev <name> -o yaml
kubectl explain agentrevocations.spec

Columns in kubectl get#

Column Type From
Action string .spec.action
Affected integer .status.affectedSessions
Expires date .spec.expiresAt
Reason string .spec.reason
Age date .metadata.creationTimestamp

Example#

From config/samples/agentrevocation-incident.yaml:

# Kill switch (F-03). Not part of kustomization.yaml: applying it stops the
# coder agent's sessions in team-a.
#   kubectl apply -f config/samples/agentrevocation-incident.yaml
#   kubectl get arev -A
# A revocation created in the gateway namespace (maqpna-system) applies to
# every namespace; match.all: true there is the global kill switch.
apiVersion: maqpna.com/v1alpha1
kind: AgentRevocation
metadata:
  name: incident-4711
  namespace: team-a
spec:
  match:                     # every non-empty field must match (AND)
    agents: ["coder"]
    sessions: ["fix-issue-*"]
  action: suspend            # block | suspend | terminate
  reason: "SOC case 4711: suspected prompt injection"
  expiresAt: "2026-10-01T00:00:00Z"

Spec fields#

AgentRevocationSpec is a kill switch / token revocation.

Field Type Required Description
action string action: block (deny calls), suspend (also suspend sessions), terminate (also fail sessions and delete their sandboxes) or quarantine (suspend, snapshot, deny-all network, revoke credentials; evidence is preserved, nothing is deleted). One of: block, suspend, terminate, quarantine. Default: "block".
expiresAt string (date-time) expiresAt ends the revocation; omitted = until deleted.
match object yes RevocationMatch selects the tokens / sessions a revocation applies to. Every non-empty field must match (AND); entries are globs (path.Match) except jtis, which are exact token IDs. Rule: match must set all=true or at least one of sessions, agents, users, jtis.
match.agents []string agents are Agent names (globs). Max items: 256.
match.all boolean all matches every token in scope: every session of this namespace, or, for a revocation created in the gateway namespace, every session in the cluster (global kill switch).
match.jtis []string jtis are token IDs (exact). A token derived by token exchange is also revoked when its parent jti is listed. Max items: 1024.
match.sessions []string sessions are AgentSession names (globs). Max items: 256.
match.users []string users are the on-behalf-of users (act.sub, globs). Max items: 256.
reason string reason is recorded in audit records and session events. Max length: 1024.

Status fields#

AgentRevocationStatus is the observed state of an AgentRevocation.

The operator writes status; do not set it yourself.

Field Type Required Description
affectedSessions integer (int32) affectedSessions counts non-terminal sessions currently matched.
appliedAt string (date-time) appliedAt is when the revocation was first published to the gateway.
conditions []object
conditions[].lastTransitionTime string (date-time) yes lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
conditions[].message string yes message is a human readable message indicating details about the transition. This may be an empty string. Max length: 32768.
conditions[].observedGeneration integer (int64) observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Minimum: 0.
conditions[].reason string yes reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. Min length: 1. Max length: 1024. Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$.
conditions[].status string yes status of the condition, one of True, False, Unknown. One of: True, False, Unknown.
conditions[].type string yes type of condition in CamelCase or in foo.example.com/CamelCase. Max length: 316. Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$.
observedGeneration integer (int64)