Scoped authority with bounded cached context

Context

The cited authorization and identity records establish scoped evaluation and the cache model. The design adds the observed baseline permissions and full signed-context lifetime to the account of that model.

A gateway cached decision and a fresh service read are different evidence of authority.

Decision

Evaluate ordinary business authority from scoped assignments and baseline self-service permissions, pass signed context to services, and retain the sixty-second gateway decision cache with thirty seconds of signed-context validity beyond it.

Alternatives Considered

Remove the gateway cache and reevaluate every request. That adds database evaluation to every protected request; the cited architecture accepted a bounded cache instead.

Guarantee immediate revocation through flushing. A successful reset response can leave a cached decision in use, so it cannot establish immediate cutoff.

Consequences

Screens and contracts describe cache/context validity without promising immediate withdrawal.

Fresh membership and security-context reads apply current active-status and assignment checks.

Staff platform assignments govern HQ system routes; ordinary customer work uses the appropriate scoped staff grant.