# Revert by query

URL: /systems/trust-and-governance/controls/revert-by-query · Id: `control:revert-by-query`

> Containment revokes the compromised token or freezes the Worker, then reverts every Event written under it as one Change.

Containment revokes the compromised token or freezes the [Worker](/business/nouns/worker), then reverts every [Event](/business/nouns/event) written under it as one [Change](/business/nouns/change).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC7.4](/systems/trust-and-governance/criteria/soc2/cc7-4) | The entity responds to security incidents with a defined program to understand, contain, remediate and communicate them. |
| [SOC2 CC7.5](/systems/trust-and-governance/criteria/soc2/cc7-5) | The entity identifies, develops and performs activities to recover from identified security incidents. |
| [ISO27001 A.5.26](/systems/trust-and-governance/criteria/iso27001/a-5-26) | Information security incidents are answered according to documented procedures. |

## Implemented by
- [Incident response](/workflows/processes/incident-response)
- [Resolve an incident](/workflows/processes/incident-response/resolve-incident)
- [Audit log](/systems/trust-and-governance/audit-log)
- [Backups](/code/platform/backups)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Incident that names a compromised token or Worker. |
| Assert | Each has a revocation or freeze, one revert Change spanning every Event written under it, and one Decision. |

## Owner
[Reliability Engineer](/agents/engineering/reliability-engineer), [Engineering Team](/agents/engineering).

## Example
A leaked token writes 41 bogus discount codes into a [SaaS](/products/templates/saas). Containment revokes the token and reverts all 41 as one Change, recorded with one [Decision](/business/nouns/decision).