Is there a way to quickly ban a user? I see a flag for disabled, and flags to revoke the user role, but neither seem to take immediate effect.

Setting disabled=true for a user is like banning a user. Users who are disabled can not sign in or request new tokens.

However, an access token is valid for 15 minutes so users are signed in for that period and that can not be changed because access tokens can not be revoked. When the user requests a new access token (valid for another 15 minutes) they won't be able to because they are disabled in the database.

You can learn about access and refresh tokens here: https://docs.nhost.io/platform/authentication/tokens

Ah, I see that makes sense