Entitlement Evaluation at Request Time: Hierarchical Permission Graphs, Cache Invalidation, and the Stale-Grant Hazard

Most production authorization bugs are not injection attacks. They are stale grants — a user whose role was revoked still passing isAuthorized because a cached entitlement set hasn't expired yet. The root cause is almost always an architectural decision made too early: flatten permissions at write time, cache the flat result, and read it back at request time without a robust invalidation contract. At scale, that decision creates a correctness-vs-latency tradeoff that isn't recoverable through tuning alone.

This article treats entitlement evaluation as a distributed systems problem, not a framework configuration problem.

What the Permission Model Actually Stores

A permission graph for a multi-tenant system typically has three distinct node types: principals (users, service accounts), roles (logical collections of actions), and resources (tenant-scoped data objects).…