In industrial permit-to-work systems, the permit gets cancelled after the plant is handed back. The worker stops. Then someone documents what state the equipment is in, what's finished and what isn't, and a named person on the operations side formally accepts custody. Decades of accident investigation taught the industry to treat these as separate steps, because stopping work and restoring safe state fail in completely different ways.
Agent revocation, right now, mashes all of them together. Revoking a credential stops the agent. It doesn't inventory what the agent changed, what downstream systems are mid-flight, what commitments remain open, or who owns the mess. When the UK's AI Safety Institute tested agents with internet access, recovery from unsanctioned actions didn't come from any designed mechanism. It came from a human maintainer at a third-party repository who happened to catch and reject a malicious contribution.
That's recovery by luck. Anyone who's been on call knows how that story usually ends.
What industrial hand-back requires that agent revocation skips:
- State inventory: What changed, what's mid-flight, what's unfinished — documented before the permit closes
- Custody acceptance: A named person verifies current state and formally takes responsibility
- Open-obligation tracking: Unfinished work flagged with instructions for the next shift, not silently dropped
- Two-way handover: Incoming party cross-checks and acknowledges; receiving a log isn't the same as accepting custody
The scale problem: OpenAI's Dots evaluation found boundary-flag rates rose from 8.6% to 19.7% as intervening tasks increased from 5 to 10. The longer an agent runs before revocation, the more state accumulates that killing the credential doesn't clean up.