---
slug: authorization_decay_before_execution
name: Authorization Decay Before Execution
one_liner: "A precondition verified at one instant authorizes an action taken at a later instant, and the relevant state changes in the gap between check and use, so the verification is true when made yet false when acted on — the defect lives in the temporal binding, not in either operation."
type: prime
schema_version: 2
status: density_v2_draft
categories: [structural, computational, epistemic]
origin_domain: computer_security
alternate_origin_domains: [finance_and_trading, access_control, healthcare_and_safety_systems]
aliases: [stale_authorization, check_use_temporal_gap, verification_staleness, expired_precondition_action]
related: []
solution_archetypes: []
review_flags:
- "OPERATOR-DERIVED (op-05 generalization) — the proposed GENUS of `time_of_check_to_time_of_use_flaw` (lift: strip the concurrency / filesystem-race frame, leaving a bare check-authorizes-later-action-across-a-gap-in-which-state-changes structure that need not involve a race or an adversary). Discovered in the op-05 remaining-strata sweep 2026-07-03. Tier B candidate. STATUS: HOLD pending owner keep/cut. COINAGE RISK: bespoke genus label minted for a single input — no established cross-domain name is asserted; keep-rate for Tier-B coinages is expected to be low."
- "Created 2026-07-03; STUB ONLY (frontmatter + Core Idea + Notes). SI/SF/similarity are PROPOSER ESTIMATES pending triangulation. Body sections (Structural Signature onward) NOT written."
- "Phase-C action: re-similarity-check vs `time_of_check_to_time_of_use_flaw` (the input) and any `provenance`, `data_integrity`, `stale_read` / `cache_invalidation`, or `race_condition` prime; confirm it is a genuine genus (covers the TOCTOU input AND the stale-quote / revoked-clearance / changed-medical-status siblings) and is not a mere restatement of the input or a domain instance of a general staleness/consistency prime; draw a subsumption edge time_of_check_to_time_of_use_flaw→candidate + sibling edges at incorporation; sync one_liner to a v1 draft per CLAUDE.md before merge."
substrate_independence:
  composite_substrate_independence: 4
  domain_breadth: 4
  structural_abstraction: 4
  transfer_evidence: 3
  reasoning: 'The bare structure — a verification whose truth about some state is established at time t1, an action that verification authorizes taken at time t2 > t1, and a change to that state in the (t1, t2) gap that silently invalidates the verification before the action fires — is medium-neutral: it needs only a "verifiable precondition," a "gap," and an "authorized action," with no commitment to filesystems, concurrency, or even adversaries. This scores higher than its framed input `time_of_check_to_time_of_use_flaw`, which carries security / race-condition vocabulary (the lift generalizes away both the race and the attacker). Domain breadth is genuine (security, trading, physical access control, clinical safety). Held off a 5 because the transfer evidence is proposer-asserted from siblings rather than triangulated, and because "authorization/verification" leans mildly on an evaluative notion of a precondition being satisfied — hence transfer_evidence 3 and a composite of 4.'
similarity_to_nearest_existing_prime:
  slug: time_of_check_to_time_of_use_flaw
  similarity: 0.74
structural_framed:
  label: structural
  aggregate: 0.26
  criteria: {vocab_travels: 0.85, evaluative_weight: 0.2, institutional_origin: 0.2, human_practice_bound: 0.2, import_vs_recognize: 0.3}
  rationale: 'Lifted out of the computer-security frame the pattern is a bare temporal-binding structure: its vocabulary (a checked precondition, a gap, a later authorized action, a state change that invalidates the check) travels cleanly to trading, access control, and clinical safety, and it carries little evaluative content beyond the mild normativity of "authorized/valid." It has no institutional home once de-framed and is recognized as a shape rather than imported as a doctrine, though the notion of a precondition being "true/false" or "authorized" keeps evaluative_weight and import_vs_recognize slightly above the floor. Net: clearly structural, aggregate low.'
phase_b_passes_completed: []
---
# Authorization Decay Before Execution

## Core Idea

Authorization Decay Before Execution is the bare structure in which *a precondition is verified at one instant, the action that verification authorizes is taken at a later instant, and the relevant state changes in the gap between the two — so the verification was sound when made and yet false by the moment of action*. The defect lives not in the check and not in the use but in the **temporal binding** between them: both operations are individually correct, and the flaw is that the authorization is treated as still valid across a gap over which it has silently decayed. The one constraint stripped to reach this genus from the input `time_of_check_to_time_of_use_flaw` is the **concurrency / filesystem-race frame** (and, with it, the assumed adversary): TOCTOU names this pattern where a racing process or attacker mutates a file between an access check and the operation on it, but the underlying shape needs neither a race nor a hostile actor — it needs only that the checked state can change and that the action fires later than the check.

The load-bearing anatomy is three parts plus a gap. First, a *verification* — a check that some precondition holds, producing an authorization to proceed; when made, it is genuinely true. Second, a *gap* — a nonzero interval between establishing the authorization and consuming it, during which no re-verification occurs. Third, a *state that can change*, so that the fact the verification asserted may cease to hold within the gap. Fourth, an *action* taken on the strength of the now-possibly-stale authorization. The characteristic payoff of this arrangement is that check and use can be *decoupled*: verifying once and acting later is efficient, avoids re-checking cost, and is often unavoidable when authorization and execution are physically or temporally separated. The characteristic cost/failure is the mirror of that decoupling — the authorization decays unnoticed and the action executes without warrant, and every remedy attacks the *gap* rather than the check or the use: shrink it to zero (atomic check-and-act), re-verify at the point of use, hold a lock or lease that freezes the state, or make the authorization carry an explicit expiry.

Read structurally, the same move recurs well outside security. A *signed price quote executed after the market moved*: the quote was a valid authorization to trade at that price when issued, but the price it certified has decayed by the time the trade fires — the trader acts on a verification that is no longer true. A *security clearance used after revocation*: access was legitimately granted, then rescinded, and the badge is presented in the window before the revocation propagates, so a sound-when-issued authorization is consumed after it has lapsed. A *medical order acted on after the patient's status changed*: an order verified against the patient's condition at rounds is carried out hours later, after the condition (or a contraindication) has shifted, making the once-correct order wrong at administration. Each is a structurally-unlike species — a price, a credential, a clinical order — yet all share the identical anatomy of a sound verification, a gap in which the underlying state moves, and a later action that inherits a decayed authorization. That is exactly what the lift captures and what `time_of_check_to_time_of_use_flaw`, bound to files and races, does not name.

## Notes

**Provenance.** Produced by operator 05 (generalization / lift) as the proposed genus of the input `time_of_check_to_time_of_use_flaw`, by stripping the concurrency / filesystem-race frame (and the assumed adversary) to expose a bare check-authorizes-later-action-across-a-mutable-gap structure. Surfaced in the op-05 remaining-strata sweep on 2026-07-03. Claimed siblings: a signed price quote executed after the market moved, a security clearance used after revocation, and a medical order acted on after the patient's status changed. Recorded as a **Tier B (B-rest)** candidate in the op-05 manifest.

**For owner evaluation (keep/cut).** The case FOR: the genus does real work the input cannot, because `time_of_check_to_time_of_use_flaw` is lexically and conceptually bound to concurrency races on files, while the stale-quote, revoked-clearance, and changed-medical-status siblings share the shape with *no race and no attacker* — the state simply moves in the gap. The portable insight is genuine and non-obvious: the flaw is a property of the *temporal binding* (check-then-use across a mutable gap), and the fix is always to attack the gap (atomicity, re-verify at use, lease/lock, expiry), never the check or the use in isolation. The RISKS, stated plainly: (1) **Coinage, not an established genus.** "Authorization Decay Before Execution" is a sonnet-minted label for a single input; no widely-used cross-domain name is asserted, so this is a coinage, and Tier-B coinages keep at a low rate. (2) **Restatement risk.** Similarity to the input is high (~0.74) — the danger is that this is TOCTOU with the security nouns filed off rather than a strictly broader genus. The discriminator: is TOCTOU already understood to include the no-race, no-adversary cases (in which case the candidate is a rename/alias), or does the community reserve TOCTOU specifically for the concurrency race (in which case a domain-neutral parent is warranted)? (3) **Alias/collapse into a staleness or consistency prime.** It must not fold into a general `stale_read` / `cache_invalidation` / `data_integrity` / `provenance` prime: those concern a value being out of date or its origin being trustworthy, whereas this prime is specifically about an *authorization* — a decision to permit an action — decaying between grant and execution; the "verified-then-acted-upon-later" decision structure is the whole point and is absent from a plain staleness prime. It should likewise not be swallowed by a generic `race_condition` prime, which is the very frame the lift removes. The sharp keep/cut question for Kurt: **is "a sound verification consumed after the state it certified has changed in the gap" a genuinely broader parent worth its own slot, or is it (a) TOCTOU already at the right level of abstraction, or (b) a special case of an existing staleness/consistency prime applied to authorizations?**

**At incorporation.** Re-run similarity against `time_of_check_to_time_of_use_flaw` (input) and any `provenance`, `data_integrity`, `stale_read`/`cache_invalidation`, and `race_condition` prime to confirm no collapse. If kept, draw a subsumption edge `time_of_check_to_time_of_use_flaw`→`authorization_decay_before_execution` and sibling/instance edges from the candidate to the stale-quote, revoked-clearance, and changed-medical-status species (or to whatever existing primes cover them). Note any missing edge if a staleness/consistency prime exists that should sit as a related-but-distinct sibling. Write a v1 draft and sync the one_liner across v1 and v2 per CLAUDE.md before merge.
