EffectBound finds authorization revocation incomplete in GitHub, Kubernetes, NATS and Kafka.

EffectBound formalizes whether revoking a grant actually removes every path by which already-authorized work can still cause an effect, reducing it to finite control with hidden state and returning a strategy, an impossibility certificate, or no verdict. Closure fails three ways across four real systems: the interface lacks a needed control, clean visible state hides active work, or the model stops before the effect frontier. A controlled run confirmed the GitHub tool cannot bind a merge to the reviewed commit and may merge a different one; NATS reports zero stored and zero pending while dispatched work can still publish downstream; and in Kafka every fixed-set broker had applied the revocation while an earlier authorized request could still append.