Every plugin you have paired with this engine. Revoking one stops it talking to the engine immediately — the plugin then asks to pair again, so this is safe to use whenever a machine leaves your hands.
A revoked device cannot be un-revoked: pair it again to bring it back. Where the engine requires pairing, revoking takes effect at once — it looks the pairing up on every protected request, so the device is refused on its next call. While the engine is only warning, nothing is refused at all, so a revoke does not reach the device until the mode changes.