Signed out on one device, still signed in on three
Access tokens are self-contained and short-lived, which is the design. Services verify them locally without calling the identity provider, which is why the architecture scales at all.
A user reports their laptop stolen and signs out everywhere. The refresh tokens are revoked immediately. The access tokens are not — nothing checks anything, so each one stays valid until it expires, on every service, with no network call that could ever learn otherwise.
Outside every boundary: Provider (refresh revoked), Transfer funds (a sensitive one), Service A (verifies locally; FAILED: still accepts), Service B (verifies locally; FAILED: still accepts), The user (laptop stolen), an empty slot for the how long a token stays valid, an empty slot for the only on the operations worth it Connections: The user calls Provider — signs out everywhere (step 1) Provider controls how long a token stays valid — issued shorter (step 2) how long a token stays valid controls Service A how long a token stays valid controls Service B Provider must NOT reach Service A — no signal arrives only on the operations worth it calls Provider — only for this one (step 3) only on the operations worth it controls Transfer funds — then allow it (step 4)