A security review flags a service-account key that an external contractor's application has been using. You need to immediately stop the key from authenticating while preserving the ability to investigate its recent activity and potentially restore access if the contractor proves it is still needed. What should you do?