> If you revoke a priv, things stop working immediately.

for a human-scaled definition of immediately, perhaps, but IAM updates are eventually consistent across the globe.