How should every record be updated when a role or signing authority…

Direct answer

Changing a role or authority is not a matter of deleting a name from one list. The change event must be recorded and propagated in a controlled way to every relevant target, including identity systems, HR records, legal records, signing matrices, access systems, API keys, devices, agents, web pages and machine-readable records.

In plain language

If you deactivate a departing employee's main-building pass but leave the warehouse key, email account and remote access active, the departure is not complete. Every door must be checked separately.

Why this matters

Incomplete offboarding leaves residual access, unauthorised representation, outdated web information and ownerless accounts. The central record may look current while real systems continue to honour the old authority.

Do not confuse

Ending a role and closing every access path are not the same event.
Suspension, revocation and expiry are different states.
Changing a record is different from applying the change in the target system.

What should you do?

Record the change identifier, type, time, reason and approval.
Use the inventory to identify every affected system and publication surface.
Close high-risk access paths first.
Check tokens, keys, sessions, group memberships and agent delegations separately.
Collect evidence of application and read-back for every target.
Do not erase records required for historical accountability.

How do you audit it?

Did the change reach every target?
Does an old session or authenticator still work?
Do web and machine-readable records show the current role?
Are any service or agent accounts now ownerless?
Is the closure decision supported by evidence?

Limit

Deletion is not always the right response. Active authority should end while historical logs, legal retention obligations and audit evidence are preserved.