What should be recorded before revoking a session?¶
Capture every available identifier, the wider account context and the risk-based rationale because the entry may disappear immediately after revocation.
Preserve the session as displayed¶
Record device, operating system, browser or application, location, IP address, sign-in and last-active times, provider session ID and labels such as current, trusted or managed.
Capture the full page and account, tenant, URL and display order before close detail or scrolling. Retain approximate provider wording rather than converting it into a precise person or place.
Record the decision and result¶
State the risk, alternatives, authority, operator and independent time. After revocation, preserve confirmation, audit reference and changes to current access, linked devices, alerts and security history.
Key takeaway
Preserve session identifiers and their uncertainty before revocation, then document the exact control and every resulting account change.
