Plans

Revoke a direct grant by id. A grant id is a **global** handle, so the route's org prefix is not what contains this: the service re-derives the row's own organization and applies tenant containment plus authority over the pattern being removed. Without that, any caller reaching this endpoint could strip authority from an actor in another organization. Revocation removes authority rather than adding it, so it cannot escalate — but it is emphatically not unauthenticated, and it is audited with the same weight as a grant.