When removing entries from an Atlas Project's IP whitelist, existing connections from those IPs are maintained, and thus those hosts can continue to perform operations until the connection times out. I'm aware such connections can be dropped by doing a Test Failover or pausing and unpausing the cluster, but in some scenarios this is not ideal if even possible. This also seems like a security gap: When access is revoked from a particular IP or CIDR block, any existing client connections originating from that IP or CIDR should be terminated and the hosts behind that IP or CIDR should be disallowed from establishing new connections until such a time as they are re-added to the whitelist, if ever.