Is there a way to implement revokable keys?

Like if I want to allow an app to post in my behalf without giving up my nsec?

Or a business Nostr profile when employees turn over?