Revoking is easy. Making it hold is the hard part.
Atoll is the durable authorization layer for Solana. Withdraw a permission and a transaction signed before it can no longer execute. The minute the withdrawal took effect goes on a permanent record.
Free to call · permissionless · built on Token ACL
Two held transactions landed after the withdrawal. Both failed.
- 21:05:48503,654,225GrantAuthoritysigned at gen 0Refused: GenerationMismatch
- 21:05:47503,654,217Settledurable nonceRefused: AuthorityWithdrawn
- 21:05:39503,654,173Withdrawngen 0 → 1
- 21:00:40503,652,368GrantAuthoritygen 0succeeded
- 21:00:38503,652,356Openedgen 0
Devnet · 24 Sep 2026 · times UTC. Every row links to Solscan.
A signature does not expire. It waits.
An ordinary Solana transaction goes stale in under a minute. A durable nonce removes that clock. The transaction stays valid for as long as a stored value is unchanged. Days. Weeks.
So “already signed” is not a window of seconds you can wait out. It is an open-ended one. Every permission you grant can be spent by a transaction that was written while you still trusted it, at a moment you do not choose.
Revoking the permission does not reach that transaction. Nothing about cancelling an authority makes an existing signature stop being a valid signature.
Schematic, not to scale.
Their transaction is durable. That is why the withdrawal has to be.
Four things we claim, and the order matters.
Two are ours. Two are parity, and we say so first.
Revoking is the easy part
Making it hold is not.
Proof of effect
You will be asked when the withdrawal took hold. Have an answer.
Enforcement inside settlement
A dashboard badge can be ignored. A settlement rule cannot.
Free at the read
Enforcement cannot fail for billing reasons.
Four steps, and none of them is us deciding anything.
Granted by a principal, held on Solana, checked by your program, withdrawn on the record.
A principal grants an authority.
One permission for one agent, signed by both: who may act, under which policy, until when. We never decide who gets it.
It lives on Solana.
With an expiry and a live withdrawal state. Any program reads it directly. No server to call, no uptime to wait on.
Programs check it before value moves.
Not after. If the authority is missing, expired or withdrawn, the transaction fails.
The withdrawal holds, and leaves a record.
The recordWhen the principal withdraws, every agent's grant goes with it. Anything signed earlier that checks Atoll fails when it lands, including a grant that would give it back. The withdrawal is written to Solana: the slot, the time, and who pulled it.
Two accounts. No signer. No payer. Nothing writable.
Any Solana program can ask whether a standing authority is still good. It costs you nothing, it needs no permission from us, and a refusal fails your transaction rather than returning a boolean you can ignore.
let mut data = Vec::with_capacity( EVALUATE_DISCRIMINATOR.len() + 2,);data.extend_from_slice(&EVALUATE_DISCRIMINATOR);data.extend_from_slice( &args.policy_version.to_le_bytes(),);// Neither account signs; neither is writable.let evaluate = Instruction { program_id: REEF_PROGRAM_ID, accounts: vec![ AccountMeta::new_readonly( ctx.accounts.grant.key(), false, ), AccountMeta::new_readonly( ctx.accounts.source_root.key(), false, ), ], data,};// A refusal here never reaches the write below.invoke( &evaluate, &[ ctx.accounts.grant.to_account_info(), ctx.accounts.source_root.to_account_info(), ctx.accounts.reef_program.to_account_info(), ],)?;Ok(())settlement continues
withdrawnslot 503,654,173 · 21:05:39 UTCon the record ↗
Program 1111…1111 invoke [1]Program 1111…1111 successProgram BZAN…jYdU invoke [1]Program log: Instruction: SettleProgram 1111…1111 invoke [2]Program 1111…1111 successProgram REEf…vsbx invoke [2]Program log: Instruction: EvaluateAuthorityProgram data: UoMELQ6fpCZQ…Program log: AnchorError thrown in programs/reef/src/authority/rules.rs:161. Error Code: AuthorityWithdrawn. Error Number: 6011. Error Message: authority has been withdrawn — the root is no longer active.Program REEf…vsbx consumed 9476 of 183282 compute unitsProgram REEf…vsbx failed: custom program error: 0x177bProgram BZAN…jYdU consumed 29044 of 202850 compute unitsProgram BZAN…jYdU failed: custom program error: 0x177b- accounts
- grant, source_root
- signers
- none
- payer
- none
- writes
- nothing
- budget
- < 20k CU
- on refusal
- your tx fails
- emits
- AuthorityEvaluated
Holding a permissioned asset instead? Reef answers Token ACL's thaw and freeze questions under the discriminators the standard fixes. You integrate nothing.