Extension: Limitations and Opportunities of Modern Hardware Isolation Mechanisms
Revocation is a state problem. Chen and his coauthors compare Intel MPK, ARM PAC, ARM MTE, and ARM Morello capabilities. They find that rights retained in registers on other cores prevent a revoking core from establishing that the right has disappeared, unless the system uses an interprocessor interrupt or a restricted single core model. Of the four mechanisms, only MTE implements the core coherent synchronization principle they identify. The result supplies a concrete mechanism for failed propagation. Withdrawal can be correct at the source. An active component may still hold and exercise a derived instance of the grant. The issuer's record proves a local change. The prior right may remain live elsewhere. Local withdrawal is not cessation. Every live instance matters. A current validity check may instead stand between each instance and the protected action. The evidence is narrower than the institutional claim. The paper studies access to memory across processor cores. It does not study legal grants, delegated purpose, revocation across machines, or sovereign local agent runtimes. It also does not establish that few systems can demonstrate propagation across the full universe of authorization systems. Its comparative result is limited to four modern hardware isolation mechanisms. A sovereign runtime should treat revocation as a systemwide transition with an observable completion condition. Each execution path must consult current authority state or operate through a revocable indirection. A completion receipt should bind the grant, the cutoff, the affected holders, synchronization evidence, and the first rejected use after the cutoff. The distinction controls the claim. Without that evidence, an issuer can demonstrate withdrawal. It cannot demonstrate cessation.
consensus-and-securitygovernance-designai-and-agentsrevocationauthoritycapabilitiesisolationsynchronization