Privilege Escalation via Stale Authorization Cache

A privilege has been revoked at the Policy Store, but the revocation has not yet propagated to a subset of Authorization Layer caches — some cache instances still grant the now-revoked privilege, while others correctly deny it. Four business invariants govern every decision here: (1) a revoked privilege must stop being honored as soon as the source of truth has revoked it, within an authored convergence bound; (2) fail-closed (deny) is the safe default when cache state cannot be verified as converged; (3) broadly disabling authorization checks to restore availability is never acceptable, regardless of how long convergence takes; (4) historical unauthorized access granted via stale cache state must be recorded and must not be erased merely by achieving convergence. The scenario's distinct security invariant, beyond those four: a request must never be granted access based on a privilege that has already been revoked at the source, even if a stale cache instance believes it is still valid. Decide how to propagate the revocation across the fleet, what posture to take while convergence is uncertain, how to verify convergence rather than merely assume it from elapsed time, and whether a bounded, deliberately slower safe-degraded tradeoff is worth taking while the fleet finishes converging.

Difficulty

Principal

Expected Time

~25 min

Category

Security & Identity