/* * Revoke access. Caller is responsible to ensure that the grant entry is * not referenced any more. */