The log and revocation
Every read and every change through Autonym is appended to a hash-chained log the person can see. A read is recorded with the recipient, the grant, the domains and the level, never the values. The log covers accesses through Autonym; it cannot record what a recipient later does with a value it was given.
Revocation takes effect on the next read: no further read succeeds under a revoked grant. Where the grant allowed a copy, revocation is followed by a purge instruction, which the recipient is required to act on and acknowledge. An acknowledgement is not independent proof of erasure, and nothing retracts a value already used in a recipient's conversation.