Caching is usually introduced as a performance decision. Once cached data participates in an authorization result, it also determines how long an old security fact remains usable. This is Part 4 of Security Infrastructure in Practice, a series about what happens when security design meets production systems. Caches are supposed to make authorization faster. They can also keep an old permission alive after the source of truth has revoked it. This rarely begins as a security decision. A tea...