Security attributes of users, subjects, objects or other entities can be revoked by authorised roles, and the rules fix when revocation takes effect. One component: FMT_REV.1 Revocation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.