Chapter 14
Permission revocation is a data-consistency problem
Updated
A removed user can still obtain a newly edited document through a search cache.
Inspect
Trace identity and permissions through ingestion, retrieval, cached results, citations, and export. Check whether the authorization snapshot is fresh enough for the content version.
Decide
Specify revocation behavior and fail-closed conditions. Partition cached data appropriately and reauthorize at the protected resource boundary; SSO alone cannot supply these guarantees.
Bring to a review
A regression sequence: grant → fetch → revoke → edit → fetch/export, across two users and two tenants.
Common trap: Testing only the initial retrieval misses caches, previews, and generated summaries.
Read
- Zanzibar: Google’s Consistent, Global Authorization System PaperRelate ACL changes to content versions without serving newly forbidden data.Focus: Paper section 2: relation tuples, the “new enemy” problem, and consistency tokens. Apply: Specify revocation and content-update ordering for a retrieval service; demonstrate a forbidden read stays forbidden.
- Authorization Cheat Sheet Deny by default and enforce authorization at every relevant request.Focus: Focus on least privilege, deny-by-default, per-request checks, and authorization regression tests. Apply: Create an access matrix with allowed and denied actions across users, tenants, resources, and exports.
- MCP Security Best Practices · draft Token audience validation, proxy consent, and token-passthrough hazards.Focus: Read confused-deputy attacks, per-client consent, token audience checks, and the prohibition on token passthrough. Apply: Draw who issues each token, its audience, which component validates it, and the downstream authorization boundary.