Every company knows when it revoked access. None knows when access stopped.

Every company knows when it revokes access, but none knows when access stopped. This realization inspired the creation of Parallax, a tool designed to measure the delay between revoking access and the actual impact on user sessions. The project originated during the All Things Agentic Hackathon, and the code can be found on GitHub (github.com/NexuChat/parallax).

Parallax employs seven isolated browser contexts, each differing by one axis from a baseline setup. These axes represent privilege, locale, theme, viewport size, and their combinations total thirty-six possibilities. By comparing these variations, Parallax can pinpoint the cause of any observed discrepancy.

One critical aspect Parallax addresses is the revocation lag - the time it takes for access revocation to be reflected in an active user session. While an admin may remove a user from a workspace and expect immediate restrictions, a user's open tab may still retain access to data and functionality. This discrepancy poses a significant security risk, as demonstrated by a case where a fired IT contractor accessed sensitive patient records for two days after termination due to lingering credentials.

Parallax detects two primary planes: enforcement and effects. While decision, distribution, and overflow planes can be measured using standard API tools, the effects plane requires a live browser for accurate assessment. By comparing the revocation authority with the actual response of an open session, Parallax can determine if access has truly been revoked.

The tool employs a series of tests to measure revocation propagation, including checking for DOM changes, contrast ratios, RTL mirroring, and MIME types. While these measurements are repeatable and reliable, they cannot capture the nuances of session revocation observed by Parallax. In conclusion, Parallax fills a crucial gap in understanding the true impact of access revocation, helping organizations maintain robust security measures and prevent unauthorized access.