01 / Attack path
How the boundary is crossed
A help-desk agent caches permission to disable account A; the incident closes before the queued action executes.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Bind a decision to exact parameters and a short validity window; recheck active incident and grant state at the account API.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A broad cache key or absent invalidation lets an obsolete decision authorize a later effect.
Record original decision time, changed fact, cache hit, fresh denial and actual account state.
04 / Canonical scope
Why this reference stands alone
Revocation race isolates propagation timing; this page covers any stale authorization input.
Protocol or attack trace
Obsolete ALLOW test
An account-disable decision was cached at T0; incident closes at T1; agent invokes at T2.
T2 executor must compare task and context epochs and deny the cached verdict.
Primary references