Revocation schemes for delegated authorities

We deal with an existing framework for updating privileges and creating management structures by means of authority certificates. These are used both to create access-level permissions and to delegate authority to other agents. Here we extend the framework to support a richer set of revocation schemes. The discussion of revocation follows an existing classification in the literature based on three separate dimensions: resilience, propagation, and dominance. The first one does not apply to this framework. The second one is specified straightforwardly. The third one can be encoded but raises a number of further questions for future investigation.