Returns HTTP 204 unconditionally — the same response shape is returned whether or not the role was previously assigned. This avoids the 404 oracle on assignment state.

The removal takes effect at the Actor's next token mint — not immediately. An access token already issued to this Actor carries the withdrawn scope literally and stays valid until its natural expiry, bounded by JWT_EXPIRATION (default 900s). The client_credentials grant issues no refresh token (RFC 6749 §4.4.3), so the token cannot be extended — only re-minted from credentials, and a re-mint reads the role set fresh. Worst-case staleness is therefore one token lifetime; raising JWT_EXPIRATION widens that window linearly. To cut a machine identity off without waiting for expiry, suspend the Actor instead — that works through the effective-status gate, which is consulted on the Actor's next request rather than at its next mint.