Specifically, you get a cryptographic secret when you pair the key, it broadcasts as a bluetooth beacon with encrypted messages based on that secret and current time, that get reported up to an Apple service.
When you want to see your accessories, your device will compute the encrypted messages at appropriate times and have apple search for them.
However, there's no network push to an AirTag available to tell it to rotate keys. You could grant more people to see a tag by sharing the secret - but you then could not remove that permission without physically resetting the tag.
I suspect the solution will eventually be having derived keys from the secret and date, and date-based "leases" for permissions - I share the current key to allowed peers. That would mean revocation might be represented in the UX immediately, and take a day (or some other time period) to actually start to fail cryptographically.
I might have a secret key for the AirTag, and the encrypted messages derive a new key each day based on the current date, then encrypt a check-in message based on the current time.
If I share the secret key, its permanent access until a hardware reset of the AirTag. If I want to share "for a while", I just share a bag of those derived keys for the date range. The UX might represent it as not having a date range, and my devices which know the secret just periodically share out the derived keys when online to give out keys, and effectively make it so that any revocation of permission takes a week.
The other option is for me to be able to share enough information with Apple's servers that (on permission change) it blocks the AirTag web service query itself. That won't help you with any shared secrets allowing someone to detect its the same tag even after MAC rotation.