health.hats.revokeAccess

End every grant the caller has given one grantee. The space host asks the coordinator before issuing each space credential, so the grantee gets no new credential from then on; a credential already issued lasts until it expires. Authenticated as the patient (service auth).