A revoke creates an audit-logged offset row — the original grant is immutable.
Remaining: 2 Ponts. Leave blank to revoke full remaining.