In some cephfs consumers, when an auth ID is denied access to a subvolume, the auth ID's caps are suitably removed and the clients that have mounted the subvolume using the auth ID are immediately evicted denying access to the subvolume. An example of this use case, is openstack manila.

See https://github.com/ceph/ceph/blob/octopus/src/pybind/ceph_volume_client.py#L405

The mgr-volumes CLI could look like,

`fs subvolume evict <volname> <subvolname> <auth name> [--group_name <group_name>]`

e.g.,
$ ceph fs subvolume evict cephfs manila-share-00 client.bob --group_name manila-share-group-00