A leaked collector credential is in use right now from an unknown source: do you withdraw it before a replacement exists?

## Two orders, and only two Under a live exposure the actions are fixed and only their order is yours: withdraw the old value, mint a replacement, move the holders across. There is no third ordering that gives you both properties, because a holder cannot present a value that does not exist yet. Either the attacker keeps a working credential while you cut over, or the fleet is broken while you mint. ## What each order costs | order | the attacker's access | legitimate holders | the cost you accept | |---|---|---|---| | withdraw, then replace | ends at the withdrawal | every holder fails until the new value lands | an outage whose length you control | | replace, move, then withdraw | continues throughout the cutover | uninterrupted | access you cannot see being used | The asymmetry is the whole argument. An outage is **bounded** — you know who it hits, you can watch it, and it ends when the last holder lands. Remaining access to an attacker is none of those things: you do not know what it is being used for, you cannot watch it from the same console, and it ends only when you finally withdraw. Given two costs, prefer the one you can measure. ## What inverts the everyday default Outside an incident, replace-then-withdraw is correct: it is the whole reason overlap exists. Three things push the other way once an exposure is live: - **Reach.** If the credential can write, move money, read customer data, or obtain further credentials, an hour of it is not comparable to an hour of degraded ingest. - **Unbounded uncertainty.** If nobody can yet say what has been done with the value, you cannot price the slow order at all — and an unpriced cost is not a cost you may accept. - **A long cutover.** Population size argues for withdrawing sooner, not later: the bigger the fleet, the longer the graceful order hands the attacker. And three push back toward cutting over first: - the credential is narrow and read-only, so the attacker's remaining hour buys little; - the holders do work that must not stop, or that is expensive and slow to restart; - you can narrow what the old value may do without withdrawing it outright. ## The middle ground, where it exists Some accepting systems let you reduce the old value's usefulness short of refusing it: accept it only from the addresses your own holders use, strip its write rights and leave read, or refuse it for the highest-reach subset while the rest cut over. Each of those is a real reduction and none of them is a refusal — the sequence still ends in a proven refusal of the whole value. The granularity frequently is not there, and designs differ; the honest answer says whether it exists here rather than assuming it does. ## Numbers, not adjectives The conversation gets decidable the moment you compute the cutover. Population divided by the rate you can actually update gives the window. Eight hundred collectors at fifty an hour is sixteen hours — so the graceful order is a proposal to leave a leaked credential working until tomorrow afternoon. Stated that way, most teams change their minds, or discover they can raise the rate for the subset that matters. State the two numbers you assumed; a window nobody computed is not a plan. ## Say the cost out loud Whichever order you take, name the accepted cost at the time and put it in the record: "we withdrew first and accepted up to sixteen hours of degraded collection", or "we cut over first and accepted that a working credential stayed in unknown hands for that window". This matters because both orders look identical afterwards when they work. The stated cost is the only evidence that a decision was made rather than fallen into, and it is what lets someone review the call without re-litigating the night. One trap to name explicitly: a cached copy does not soften the withdraw-first outage. A cached credential that has been withdrawn is refused exactly like a freshly presented one, because the refusal happens at the system being called, not at the holder.