An Access Lease has two clocks

Standing authority and request authority move on different timescales.

An Entitlement is the time-bounded authorisation an administrator grants to a Human or Agent Principal in one Environment. It holds no request token by itself.

An Access Lease is minted under that Entitlement. It is shorter, reaches one Environment, and is the authority a mediated request spends. In the Tier 1 base-URL path, its bearer lifetime is capped at 15 minutes; Tier 2 uses qevra run and a machine-local listener.

Revoking the Entitlement ends the ability to authorise later calls. The proof-first target is measured denial within 10 seconds in one region, not an instantaneous or multi-region guarantee.