The code checked authorization.
But it checked yesterday's truth.

subject.id = user-123
resource.type = CASE

subject.status = ACTIVE
subject.roles = [CASE_REVIEWER]
resource.assignedOfficerId = user-123
resource.classification = INTERNAL
policy.version = 2026-07-03.5
subject.currentRiskLevel = LOW

A valid token proves that the token is valid.
It does not prove every mutable authorization fact inside it is still true.

{
  "iss": "https://idp.example.com",
  "sub": "user-123",
  "aud": "case-api",
  "exp": 1783094400,
  "iat": 1783090800,
  "scope": "case:read case:update",
  "tenant_id": "tenant-a",
  "roles": ["case_reviewer"]
}

Who is calling?
Was this token issued by a trusted issuer?
Is the token intended for this API?
Is the token still cryptographically valid?

Can this subject approve this exact case right now?
Can this subject view this exact evidence attachment right now?
Can this subject export all records matching this query right now?

user.status changed ACTIVE -> SUSPENDED
user.role CASE_APPROVER revoked
user.department changed Enforcement -> Legal
user.clearance changed CONFIDENTIAL -> INTERNAL
user.manager changed
user.tenant membership removed
user.delegation expired
user.breakGlassSession ended
user.riskScore increased

case.assignee changed user-123 -> user-456
case.status changed DRAFT -> CLOSED
case.classification changed INTERNAL -> RESTRICTED
case.tenant changed due to migration
case.jurisdiction changed
case.legalHold applied
case.ownerOrganization changed
case.relatedEntity became politically exposed

user no longer member of team that owns folder
case moved to a unit the user cannot access
document shared link revoked
parent organization changed
case delegated to another region

policy now requires maker-checker
policy now forbids self-approval
policy now requires higher clearance for export
policy now blocks access outside office hours
policy version 12 rolled back to version 11

device compliance changed
IP risk changed
session age exceeded threshold
network zone changed
maintenance freeze started
incident mode activated

Identity claims may be token-local.
Coarse scopes may be token-local with short lifetime.
Object-level facts must be checked from service-owned data or fresh-enough projections.
High-risk administrative rights must not rely only on long-lived JWT claims.

How stale may the authorization facts be before the decision becomes unsafe?

public enum FreshnessRequirement {
    TOKEN_LOCAL,
    BOUNDED_STALE,
    FRESH_READ,
    TRANSACTIONAL
}

public record FreshnessPolicy(
        FreshnessRequirement requirement,
        Duration maxAge,
        boolean failClosedWhenUnknown
) {}

public enum CaseAction {
    VIEW_SUMMARY(new FreshnessPolicy(FreshnessRequirement.BOUNDED_STALE, Duration.ofSeconds(60), true)),
    UPDATE_DETAILS(new FreshnessPolicy(FreshnessRequirement.FRESH_READ, Duration.ZERO, true)),
    APPROVE_RECOMMENDATION(new FreshnessPolicy(FreshnessRequirement.TRANSACTIONAL, Duration.ZERO, true)),
    EXPORT_EVIDENCE(new FreshnessPolicy(FreshnessRequirement.FRESH_READ, Duration.ZERO, true));

    private final FreshnessPolicy freshnessPolicy;

    CaseAction(FreshnessPolicy freshnessPolicy) {
        this.freshnessPolicy = freshnessPolicy;
    }

    public FreshnessPolicy freshnessPolicy() {
        return freshnessPolicy;
    }
}

Worst-case token-only revocation delay ~= access token lifetime

Use JWT/token claims for identity and coarse admission.
Use current or bounded-current authorization data for protected decisions.

Access token TTL: 5-15 minutes
Refresh token/session controlled by identity provider

{
  "sub": "user-123",
  "session_version": 41,
  "permission_version": 8
}

subject_id=user-123
current_session_version=42
current_permission_version=9

public final class SubjectVersionGuard {
    private final SubjectVersionRepository repository;

    public void verifyNotStale(TokenPrincipal principal) {
        SubjectVersion current = repository.getCurrentVersion(principal.subjectId());

        if (principal.sessionVersion() < current.sessionVersion()) {
            throw new AccessDeniedException("stale_session");
        }

        if (principal.permissionVersion() < current.permissionVersion()) {
            throw new AccessDeniedException("stale_permissions");
        }
    }
}

revoked_jti:{token-id} -> expires at token exp

{
  "eventType": "PermissionChanged",
  "subjectId": "user-123",
  "tenantId": "tenant-a",
  "permissionVersion": 19,
  "occurredAt": "2026-07-03T09:15:30Z"
}

public record AuthorizationDecision(
        DecisionEffect effect,
        String reasonCode,
        String policyVersion,
        Instant evaluatedAt
) {}

Read resource + evaluate policy version 15.
Before commit, verify active policy version is still 15.
If version changed, retry or deny.

user-123:case:update -> permit

public record DecisionCacheKey(
        String subjectId,
        String tenantId,
        String action,
        String resourceType,
        String resourceId,
        String resourceAuthzVersion,
        String subjectPermissionVersion,
        String policyVersion,
        String environmentClass
) {}

Which input changes would make the decision different?

Stale deny -> user annoyance / support ticket
Stale permit -> data breach / unauthorized action

subjectPermissionVersion
resourceAuthzVersion
policyVersion
relationshipVersion

WHERE tenant_id = :tenantId
  AND assignee_id = :subjectId
  AND classification <= :clearance

DRAFT -> REVIEW_PENDING -> APPROVED

if (attribute.isCritical() && attribute.freshness().isUnknown()) {
    return AuthorizationDecision.deny("critical_attribute_freshness_unknown");
}

public record AttributeValue<T>(
        String name,
        T value,
        Instant observedAt,
        String source,
        String version,
        boolean authoritative
) {
    public boolean olderThan(Duration maxAge, Clock clock) {
        return observedAt.plus(maxAge).isBefore(clock.instant());
    }
}

public record AuthorizationAttributes(
        AttributeValue<String> subjectStatus,
        AttributeValue<Set<String>> subjectRoles,
        AttributeValue<String> resourceState,
        AttributeValue<String> resourceClassification,
        AttributeValue<String> resourceAssignee,
        AttributeValue<String> policyVersion
) {}

public final class FreshnessValidator {
    private final Clock clock;

    public FreshnessValidator(Clock clock) {
        this.clock = clock;
    }

    public void requireFresh(AttributeValue<?> attribute, Duration maxAge) {
        if (attribute.observedAt() == null) {
            throw new IndeterminateAuthorizationException(
                    "attribute_freshness_unknown:" + attribute.name()
            );
        }

        if (attribute.olderThan(maxAge, clock)) {
            throw new IndeterminateAuthorizationException(
                    "attribute_stale:" + attribute.name()
            );
        }
    }
}

@PreAuthorize("hasRole('CASE_APPROVER')")
public void approveCase(String caseId) {
    caseRepository.approve(caseId);
}

public void approveCase(Principal principal, CaseId caseId, ApprovalCommand command) {
    CaseRecord caseRecord = caseRepository.findForUpdate(caseId)
            .orElseThrow(NotFoundException::new);

    AuthorizationDecision decision = authorizationService.authorize(
            AuthorizationRequest.builder()
                    .subject(SubjectRef.user(principal.subjectId()))
                    .action("case.approve")
                    .resource(ResourceRef.of("case", caseId.value()))
                    .tenantId(caseRecord.tenantId())
                    .resourceVersion(caseRecord.authzVersion())
                    .context("caseState", caseRecord.state())
                    .context("classification", caseRecord.classification())
                    .context("createdBy", caseRecord.createdBy())
                    .context("assignedOfficer", caseRecord.assignedOfficerId())
                    .freshnessRequirement(FreshnessRequirement.TRANSACTIONAL)
                    .build()
    );

    decision.requirePermit();

    caseRecord.approve(command.reason(), principal.subjectId());
    caseRepository.save(caseRecord);
}

public record TokenPrincipal(
        String subjectId,
        String issuer,
        String audience,
        Instant issuedAt,
        Instant expiresAt,
        Set<String> scopes,
        Optional<String> tenantHint,
        Optional<Long> permissionVersion,
        Map<String, Object> rawClaims
) {}

public final class SubjectAttributeResolver {
    private final SubjectRepository subjectRepository;
    private final PermissionRepository permissionRepository;

    public SubjectAttributes resolve(TokenPrincipal principal, FreshnessPolicy freshnessPolicy) {
        SubjectRecord subject = subjectRepository.findById(principal.subjectId())
                .orElseThrow(() -> new AccessDeniedException("subject_not_found"));

        if (!subject.active()) {
            throw new AccessDeniedException("subject_inactive");
        }

        if (freshnessPolicy.requirement() == FreshnessRequirement.TOKEN_LOCAL) {
            return SubjectAttributes.fromToken(principal, subject.statusVersion());
        }

        EffectivePermissions permissions = permissionRepository.resolveEffectivePermissions(
                principal.subjectId(),
                freshnessPolicy.maxAge()
        );

        return new SubjectAttributes(subject, permissions);
    }
}

For case.view.summary:
  - permit cache allowed
  - max decision TTL = 30 seconds
  - key includes subjectPermissionVersion + resourceAuthzVersion + policyVersion
  - role revocation event invalidates subject key
  - case reassignment event invalidates resource key
  - cache miss falls back to DB/PDP
  - cache outage fails closed for restricted resources, degrades for low-risk resources

public record DecisionCachingPolicy(
        boolean cacheable,
        Duration permitTtl,
        Duration denyTtl,
        Set<String> requiredVersionDimensions,
        boolean failClosedOnCacheUncertainty
) {}

public final class CaseAuthorizationPolicyCatalog {
    public DecisionCachingPolicy cachingPolicy(String action) {
        return switch (action) {
            case "case.view.summary" -> new DecisionCachingPolicy(
                    true,
                    Duration.ofSeconds(30),
                    Duration.ofMinutes(2),
                    Set.of("subjectPermissionVersion", "resourceAuthzVersion", "policyVersion"),
                    true
            );
            case "case.approve", "case.exportEvidence" -> new DecisionCachingPolicy(
                    false,
                    Duration.ZERO,
                    Duration.ZERO,
                    Set.of(),
                    true
            );
            default -> new DecisionCachingPolicy(false, Duration.ZERO, Duration.ZERO, Set.of(), true);
        };
    }
}

invalidation event + TTL safety net + version verification for critical decisions

ALTER TABLE subject_permission_state
ADD COLUMN authz_version BIGINT NOT NULL DEFAULT 0;

ALTER TABLE case_record
ADD COLUMN authz_version BIGINT NOT NULL DEFAULT 0;

UPDATE case_record
SET assigned_officer_id = :newOfficer,
    authz_version = authz_version + 1,
    updated_at = now()
WHERE id = :caseId;

{
  "eventType": "CaseAuthorizationChanged",
  "caseId": "case-789",
  "tenantId": "tenant-a",
  "authzVersion": 42,
  "changedFields": ["assignedOfficerId", "classification"],
  "occurredAt": "2026-07-03T09:15:30Z"
}

public void onCaseAuthorizationChanged(CaseAuthorizationChanged event) {
    cache.invalidateResource(event.tenantId(), "case", event.caseId());
    resourceVersionCache.putIfNewer(event.caseId(), event.authzVersion());
}

1. Read case.
2. Authorize case.approve.
3. Another transaction reassigns case or changes state.
4. Approve using old authorization basis.

1. Start transaction.
2. Lock or version-check resource.
3. Evaluate authorization against current state.
4. Execute transition with expected version/state condition.
5. Commit.

@Transactional
public void approveCase(Principal principal, CaseId caseId, long expectedVersion) {
    CaseRecord caseRecord = caseRepository.findById(caseId)
            .orElseThrow(NotFoundException::new);

    if (caseRecord.version() != expectedVersion) {
        throw new ConflictException("case_changed_retry_required");
    }

    authorizationService.authorize(
            AuthorizationRequest.forAction(principal.subjectId(), "case.approve", caseId.value())
                    .withTenant(caseRecord.tenantId())
                    .withResourceVersion(caseRecord.authzVersion())
                    .withContext("state", caseRecord.state())
                    .withContext("assignedOfficerId", caseRecord.assignedOfficerId())
                    .withFreshness(FreshnessRequirement.TRANSACTIONAL)
    ).requirePermit();

    caseRecord.approve(principal.subjectId());
}

UPDATE case_record
SET state = 'APPROVED',
    approved_by = :subjectId,
    version = version + 1,
    authz_version = authz_version + 1
WHERE id = :caseId
  AND tenant_id = :tenantId
  AND version = :expectedVersion
  AND state = 'REVIEW_PENDING'
  AND assigned_officer_id = :subjectId;

User disabled -> all write actions denied within 10 seconds.
Admin role revoked -> admin actions denied within 5 seconds.
Case reassigned -> old assignee cannot update case within 3 seconds.
Policy emergency deny -> all affected actions denied within 2 seconds.
Break-glass expired -> all break-glass decisions denied immediately at next request.

authz.revocation.propagation.delay_ms
authz.cache.hit.count
authz.cache.stale_hit.prevented.count
authz.decision.indeterminate.count
authz.attribute.stale.count
authz.subject_version_mismatch.count
authz.policy_version_mismatch.count
authz.event_invalidation.lag_ms
authz.permit_with_token_only.count

{
  "decisionId": "dec-123",
  "effect": "DENY",
  "reasonCode": "subject_permission_version_stale",
  "subjectId": "user-123",
  "action": "case.approve",
  "resourceType": "case",
  "resourceId": "case-789",
  "tokenIssuedAt": "2026-07-03T09:00:00Z",
  "tokenExpiresAt": "2026-07-03T09:15:00Z",
  "tokenPermissionVersion": 18,
  "currentPermissionVersion": 19,
  "policyVersion": "2026-07-03.5",
  "evaluatedAt": "2026-07-03T09:10:10Z"
}

public enum DecisionEffect {
    PERMIT,
    DENY,
    INDETERMINATE
}

public void requirePermit() {
    if (effect != DecisionEffect.PERMIT) {
        throw new AccessDeniedException(reasonCode);
    }
}

if (decision.effect() == DecisionEffect.DENY) {
    throw new AccessDeniedException();
}
// BUG: indeterminate becomes permit

@Bean
SecurityFilterChain security(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(authz -> authz
                    .requestMatchers("/actuator/health").permitAll()
                    .requestMatchers(HttpMethod.GET, "/api/cases/**").authenticated()
                    .requestMatchers(HttpMethod.POST, "/api/cases/**").authenticated()
                    .anyRequest().denyAll()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
            .build();
}

@Service
public class CaseApplicationService {
    private final CaseRepository caseRepository;
    private final AuthorizationService authorizationService;

    public CaseDto updateCase(Principal principal, CaseId caseId, UpdateCaseCommand command) {
        CaseRecord caseRecord = caseRepository.findById(caseId)
                .orElseThrow(NotFoundException::new);

        authorizationService.authorize(
                AuthorizationRequest.builder()
                        .subject(SubjectRef.user(principal.subjectId()))
                        .action("case.update")
                        .resource(ResourceRef.of("case", caseId.value()))
                        .tenantId(caseRecord.tenantId())
                        .resourceVersion(caseRecord.authzVersion())
                        .context("state", caseRecord.state())
                        .context("classification", caseRecord.classification())
                        .build()
        ).requirePermit();

        caseRecord.update(command);
        return CaseDto.from(caseRepository.save(caseRecord));
    }
}

@Test
void revokedRoleMustNotPermitApprovalEvenWhenJwtStillContainsRole() {
    TokenPrincipal principal = token(
            "user-123",
            Set.of("case_approver"),
            permissionVersion(7)
    );

    permissionRepository.setCurrentVersion("user-123", 8);
    permissionRepository.removeRole("user-123", "case_approver");

    AuthorizationDecision decision = authorizationService.authorize(
            request(principal, "case.approve", "case-789")
    );

    assertThat(decision.effect()).isEqualTo(DecisionEffect.DENY);
    assertThat(decision.reasonCode()).isEqualTo("subject_permission_version_stale");
}

@Test
void oldAssigneeCannotUpdateAfterCaseReassigned() {
    caseRepository.save(caseRecord("case-789")
            .assignedTo("user-123")
            .authzVersion(10));

    AuthorizationDecision before = authorizationService.authorize(
            request("user-123", "case.update", "case-789")
    );

    assertThat(before.effect()).isEqualTo(DecisionEffect.PERMIT);

    caseRepository.reassign("case-789", "user-456");

    AuthorizationDecision after = authorizationService.authorize(
            request("user-123", "case.update", "case-789")
    );

    assertThat(after.effect()).isEqualTo(DecisionEffect.DENY);
}

@Test
void cachedPermitMustBeInvalidatedWhenResourceAuthzVersionChanges() {
    DecisionCacheKey oldKey = key("user-123", "case.update", "case-789", "resourceVersion=10");
    cache.put(oldKey, AuthorizationDecision.permit("policy-v1"));

    caseRepository.updateAuthzVersion("case-789", 11);

    AuthorizationDecision decision = authorizationService.authorize(
            request("user-123", "case.update", "case-789")
    );

    assertThat(decision.cacheHit()).isFalse();
}

@Test
void staleAttributeMustBecomeIndeterminateAfterMaxAge() {
    MutableClock clock = new MutableClock(Instant.parse("2026-07-03T10:00:00Z"));

    AttributeValue<String> status = new AttributeValue<>(
            "subject.status",
            "ACTIVE",
            clock.instant(),
            "subject-db",
            "v12",
            true
    );

    clock.advance(Duration.ofMinutes(10));

    assertThatThrownBy(() -> freshnessValidator.requireFresh(status, Duration.ofMinutes(5)))
            .isInstanceOf(IndeterminateAuthorizationException.class);
}

1. Token claims identify the caller; they do not replace object-level authorization.
2. Every high-risk action must define freshness requirements.
3. Mutable authorization facts need timestamp/version/source.
4. Cache decisions only when all decision-changing dimensions are represented by key, TTL, or invalidation.
5. Prefer version-bound permit cache over blind TTL-only permit cache.
6. Treat indeterminate as deny at the enforcement point.
7. Recheck authorization inside the transaction for state-changing operations.
8. Measure revocation delay as an operational SLO.
9. Use events for fast invalidation but TTL/version checks for correctness.
10. Do not put your entire authorization model inside JWT claims.

Officer A is assigned to case C.
Officer A has token issued at 09:00 with role CASE_OFFICER.
At 09:05, case C is reassigned to Officer B.
At 09:06, Officer A attempts to upload evidence to case C.

Token has CASE_OFFICER.
Endpoint checks @PreAuthorize("hasRole('CASE_OFFICER')").
Upload succeeds.

Token identifies Officer A.
Service loads current case C.
Authorization checks tenant, assignment, state, classification, and policy.
case.assignedOfficerId = Officer B.
Decision = DENY.
Audit reason = not_assigned_to_case.

Upload command writes through scoped repository or conditional predicate:
WHERE case_id = :caseId
  AND tenant_id = :tenantId
  AND assigned_officer_id = :subjectId
  AND state IN ('OPEN', 'INVESTIGATION')

Did we check permission?

Which facts did we check?
How fresh were they?
Who owns them?
What version were they?
What happens when they change?
How fast does revocation propagate?
What happens when freshness cannot be proven?
Can we prove this later from audit evidence?