A session can be revoked by the team member it belongs to, by the project owner or by a manager; nobody else can revoke someone else's session.
On the PC, SyncNow stops that session's local connection and deletes its folder in the transfer area. The agent's next operation in that session is refused and nothing is done (typically with SESSION_NOT_ACTIVE); to go on, it calls open_project for a new session. A summary sent with finish_session after the revocation is kept for the record but is not handed to the next agent.
A single refused operation does not revoke anything: an action outside the rules, such as a path outside the project root or a secret file, is refused on its own and recorded as a warning, and the session goes on. Revoking a manager's access in Managers has a wider effect, because the capabilities of all their agents stop working.