secretsmgr revoke prod alice # one vault
secretsmgr revoke-principal alice # everything, e.g. an offboarding
Three things then happen, and the third is the one that matters:
Alice's grants are marked revoked with a signed statement.
Anyone Alice granted access to is reviewed as well. The tool follows the chain of who granted whom and shows you the full list before doing anything. This is called a cascade, and it defaults to a dry run because cascading a well-connected colleague can remove more people than you expect.
Each affected vault gets a fresh vault key, handed to everyone who remains. Nothing written from this moment on can be read with anything Alice ever held. Then the tool prints a value-rotation checklist.
Alice can still log in until you finish that checklist
Alice still has every encrypted file she ever fetched, plus the entire git history, plus her memory. Revoking her access stops her reading future values. It does not take back the current ones. Until you change the actual passwords on that checklist, she can still log into those systems.