# RevokePermissionFromRole

## Permission Scope

role

## Overview

RevokePermissionFromRole removes a permission key from a role's `permissions` array. When the permissions array changes, an executor recomputes effective permissions for all users assigned to the role.

## Business Rules

- Role must exist in the system
- Permission key must exist in the role's permissions array
- Removes the permission key from the role's permissions array
- Triggers executor to recompute effective permissions for affected users

## Process Flow

```mermaid
flowchart TD
    A[Receive revoke request] --> B{Role exists?}
    B -->|No| C[Return error: ROLE_NOT_FOUND]
    B -->|Yes| D{Permission in array?}
    D -->|No| E[Return error: PERMISSION_NOT_FOUND]
    D -->|Yes| F[Remove permission from role's permissions array]
    F --> G[Return success]
```

## External Dependencies

- None

## Error Scenarios

- **ROLE_NOT_FOUND**: Specified role ID does not exist
- **PERMISSION_NOT_FOUND**: Permission key is not in the role's permissions array - return not found error indicating the permission is not assigned to this role

## Test Cases

- throws when role does not exist
- throws when permission is not in the role's permissions array
- removes permission key from role's permissions array