Tensions in Practice: Expiring authority in tension with resumable work¶
Temporary grants · paused work
A task starts with temporary permission, pauses, and resumes later. The task can still be legitimate even though its grant has expired. A fixed short window limits how long that credential works; renewal lets the unfinished work continue only after its permission is reconsidered. Neither the task’s identity nor its unfinished status automatically extends its authority.
Limit standing authority
Keep an old credential from remaining usable indefinitely.
Allow legitimate resumption
Avoid stranding authorized work merely because a pause outlasted its original grant.
Why these aims pull against each other
Task duration and credential lifetime are different clocks. Tight expiry reduces standing exposure while creating a dependency on fresh authorization for late resumption.
Choose an arrangement to see what changes and what remains difficult.
Qualitative paths and conditions, not measured costs, timings or performance guarantees.
What this choice protects
What it costs
When it fits
Compare the arrangements
Keep the fixed window
Use a bounded grant and accept that work resuming after expiry cannot proceed under it.
- What it protects
- The old credential stops working without waiting for a separate withdrawal message.
- What it costs
- A legitimate long-running or paused task can be stranded until another authorized path is available.
- When it fits
- Fits tasks that reliably complete within the window, or contexts where late continuation should deliberately fail rather than extend old authority.
Illustration note: The timeline is editorial and has no numerical lifetime. Expiry is assumed to be enforced by a trustworthy clock.
Renew for resumption
Before resuming expired work, recheck the authorization precondition and issue a new bounded grant if it remains justified.
- What it protects
- A legitimate task can continue without treating its original grant as permanent.
- What it costs
- The issuer must be reachable and perform additional work; renewal can fail or correctly refuse changed circumstances.
- When it fits
- Fits resumable work whose current scope can be checked and whose availability can tolerate the renewal dependency.
Illustration note: The source supplies renewal by fresh issuance. Automatic renewal without a current check would not establish the contract shown here.
What this illustration does—and does not—establish
Least Privilege Principle of Least Privilege: Temporal Scoping versus Availability (temporal) supplies premature expiry versus availability. Lease-Bound Capability Token supplies renewal and its cost.
- Extending a grant is not proof that its underlying authorization remains valid.
- A duplicate-detection record and a permission grant serve different purposes: one remembers prior execution, the other allows present action.
- No expiry duration, emergency exception, or security guarantee is supplied.
Source entries
Principle of Least Privilege
Principle of Least Privilege: Temporal Scoping versus Availability (temporal) supplies the conflict examined here.
Temporal Scoping versus Availability (temporal)
T3 — Temporal Scoping versus Availability (temporal). The principle says revoke authority when its function ends, shrinking the blast radius over time — but premature or automated revocation can strand a long-running or resumable task that legitimately needed the grant later. Just-in-time access trades standing risk for availability risk. Failure mode: a credential expiring mid-operation, converting a security feature into an outage. Diagnostic: does the revocation schedule match the actual lifetime of the authorized function, including retries and resumptions, or a convenient fixed TTL?
Lease-Bound Capability Token
Supplies fresh bounded renewal rather than silently patching an expired grant.
Tuning parameters
- Lease length — shorter windows shrink the staleness gap but multiply renewals and load on the issuer; the central trade-off of the whole mechanism.
How it works
- Renew, don't patch. Continued access means re-checking the precondition and re-issuing a *new* lease; each renewal re-attaches the grant to current state.