# RevokePermissionFromRole

## Overview

RevokePermissionFromRole removes an association between a permission and a role, revoking that permission from all users who have the role assigned. This command is used when restructuring role capabilities or removing permissions that are no longer appropriate.

The association must exist before it can be revoked.

## Business Rules

- Role must exist in the system
- Permission must exist in the system
- RolePermission association must exist
- Removes the RolePermission association record
- Generates PERMISSION_REVOKED audit event with actor ID, role ID, permission ID, and timestamp

## Process Flow

```mermaid
flowchart TD
    A[Receive revoke request] --> B{Role exists?}
    B -->|No| C[Return error: ROLE_NOT_FOUND]
    B -->|Yes| D{Permission exists?}
    D -->|No| E[Return error: PERMISSION_NOT_FOUND]
    D -->|Yes| F{Assignment exists?}
    F -->|No| G[Return error: ASSIGNMENT_NOT_FOUND]
    F -->|Yes| H[Delete RolePermission record]
    H --> I[Log PERMISSION_REVOKED audit event]
    I --> J[Return success]
```

## External Dependencies

- None

## Error Scenarios

- **ROLE_NOT_FOUND**: Role ID does not exist in the system - return not found error with the provided role ID
- **PERMISSION_NOT_FOUND**: Permission ID does not exist in the system - return not found error with the provided permission ID
- **ASSIGNMENT_NOT_FOUND**: Role does not have this permission assigned - return not found error indicating the association does not exist

## Test Cases

- throws when role does not exist
- throws when permission does not exist
- throws when assignment does not exist
- deletes RolePermission
