Researchers propose a bounded outcome contract (C0-C5) to ensure revocation is complete at receipt in distributed agent-tool gateways. They implement and test it with Keycloak, OPA/Toxiproxy, and a live LLM workflow, demonstrating its effectiveness.