The node should make a new address.
All assets belonging to the old address (with the compromised private key) should be immediately transferred to the new address.
Any permissions belonging to the old address should be given also to the new one.
Then all permissions should be revoked for the old address.