X can deny Y's access iff every live route from the subject to Y transits X's admin reach. So availability is a min-cut over roles, and the power is deny-only and attributable.

It turns a vague fear, that anyone upstream can grief you, into something you can compute and design around.

Reach is where you hold keys, plus your own strip. A revocation unplugs cords in your rooms. So when can X cut off Y?

Exactly when every live route to Y passes through a room X holds a key to. Or through X's own strip. Not more. Not less.

A second route protects you only if it runs through different rooms. Two cords through the same role are one cord.

Who holds keys? Admins. Only admins. The one exception is your inviter: if your only route runs through their strip, they can unplug you from it.

And it is bounded. They can never read, write, or escalate. Every revocation is signed, so a spree is a confession. Nothing is taken from you. You keep your copy, and everything you already decrypted.

Rooms near the socket sit on more routes. But fewer people ever held keys to them. The root can cut everything. That is just ownership.

Any system where removal is durable hands every remover this power. Keyline chose durable, then shrank the surface: reach, rotation, flat roles.

Check yourself. Carol has two routes to the document, both through Members. Does the second route protect her from an ex-admin of Members?