let's have one callback per grant or revoke

not one per granted or revoked gate
only call after_{grant,revoke} callbacks if key changed