Switches the declaration off. From the very next request, tokens from this issuer
are refused — indistinguishably from every other cause, so a client cannot learn
from the refusal that the issuer was ever trusted.

Everything else is kept: the row, its bindings and its history. The workloads bound to it still exist as actors and keep any other credentials they hold, so re-enabling restores the previous state exactly.

Ungated, and that is a deliberate asymmetry with enable. A

tenant must be able to reduce its own exposure whatever its billing state has done.
Gating the off switch behind an entitlement would mean a downgraded customer could
not turn off trust they no longer want — the opposite of what a commercial state
should produce.