Review the grants
Have an authorized Azure administrator identify the RATIVERA principal and its Discovery Reader subscription assignments and Evidence Reader assignments on each enrolled AKS resource. Check for any additional grants rather than relying only on role names.
Revoke the intended access
Use Azure Access control (IAM) at the relevant scope to remove the intended role assignments. Removing Discovery Reader alone does not stop evidence acquisition for an already connected cluster; Evidence Reader includes its own cluster-read permission. Coordinate tenant consent revocation with your administrator if withdrawing all tenant authorization.
Verify and separate follow-up
Confirm the relevant grants are gone and subsequent reads fail as expected, allowing for Azure permission propagation. Coordinate disconnection with RATIVERA. Removing Azure access does not itself delete stored data, cancel billing, or uninstall shared Azure monitoring. Request the applicable deletion and account-closure process separately; no retention period is promised here.