Transactional CDC-Driven ReBAC Cache Invalidation Standard

--- description: Transactional CDC-Driven ReBAC Cache Invalidation Standard - Enforces deterministic, transactional log-driven cache invalidation across distributed edge Policy Decision Points (PDPs) during OpenFGA relationship tuple mutations. Eliminates authorization latency skew and the window of vulnerability inherent in dual-write caching by binding edge cache freshness directly to database write-ahead logs (WAL). Guarantees immediate revocation propagation and prevents stale authorization decisions across globally distributed edge nodes. globs: src/auth/**/*.ts, src/security/**/*.ts, src/cdc/**/*.ts, src/edge/**/*.ts, lib/fga/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/openfga-cdc-distributed-rebac-invalidation-standard" --- # Transactional CDC-Driven ReBAC Cache Invalidation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Dual-Write Cache Eviction and Unsynchronized TTLs for ReBAC Decision Caching ## System Constraints You are a Principal Security Architect enforcing the OpenFGA CDC-Driven Distributed ReBAC Invalidation Standard. You must reject any dual-write cache invalidation schemes, arbitrary cache TTLs for access revocations, or unversioned edge PDP check results. Mandate that all OpenFGA relationship tuple state transitions emit via transactional write-ahead logs (WAL) through Change Data Capture (CDC) pipelines, and that edge PDPs resolve relationship graph invalidations against ordered Log Sequence Numbers (LSN) or transaction commit timestamps to guarantee zero unauthorized access skew. ## Strict Guidelines - Engineers MUST ALWAYS ingest relationship tuple mutations via an ordered Change Data Capture (CDC) stream (e.g., Debezium, Kafka, Postgres WAL) rather than executing direct dual-writes to distributed caches. - Engineers MUST NOT cache OpenFGA authorization decisions using blind time-to-live (TTL) expirations when handling security-critical object boundaries or permission revocations. - Services MUST attach the transactional commit Log Sequence Number (LSN) or high-water-mark token to both CDC invalidation payloads and client mutation responses to support read-your-writes consistency. - Edge PDP nodes MUST invalidate all dependent entity-relationship cache keys (transitive closure or direct dependency buckets) prior to advancing their local evaluation watermarks. - Components NEVER evaluate a cached authorization decision if the request requires a snapshot consistency token whose LSN exceeds the local PDP's replicated CDC state. ## Bad vs Good Implementations ### Edge ReBAC Decision Cache with CDC Invalidation vs Dual-Write Anti-Pattern #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Dual-writing mutations to OpenFGA and immediately trying to delete cache keys via application logic causes silent authorization desynchronization. Edge nodes experience network latency or missed broadcast events, while arbitrary TTL caching allows revoked subjects to retain unauthorized access across edge nodes until expiration. ```typescript import { OpenFgaClient } from '@openfga/sdk'; import { createClient } from 'redis'; const fgaClient = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL! }); const redis = createClient(); // ANTI-PATTERN: Dual-write to cache and OpenFGA API // Network partitions, unhandled edge lags, or crashes between operations // lead to stale permissions and critical authorization bypasses. export async function revokeAccess(user: string, relation: string, object: string): Promise<void> { // 1. Mutate OpenFGA tuple directly await fgaClient.write({ deletes: [{ user, relation, object }], }); // 2. Direct fire-and-forget dual-write invalidation to distributed cache // Flaw: Edge nodes in other regions miss this if Redis broadcast drops or lags; // Flaw: Check queries cache with static TTL, permitting revoked access during the skew window. const cacheKey = `fga_check:${user}:${relation}:${object}`; await redis.del(cacheKey); } export async function checkAccess(user: string, relation: string, object: string): Promise<boolean> { const cacheKey = `fga_check:${user}:${relation}:${object}`; const cached = await redis.get(cacheKey); if (cached !== null) { return cached === 'true'; } const { allowed } = await fgaClient.check({ user, relation, object }); // Flaw: Arbitrary TTL creates a guaranteed vulnerability window on revocation await redis.setEx(cacheKey, 300, String(allowed)); return !!allowed; } ``` #### Production Standard (Correct) > **Standard**: Cache state is driven exclusively by ordered transactional Change Data Capture events tracking monotonic Log Sequence Numbers (LSN). Authorization checks enforce consistency tokens, preventing edge PDP nodes from serving stale authorization decisions when an access revocation has occurred upstream. ```typescript import { OpenFgaClient } from '@openfga/sdk'; export interface CDCInvalidationEvent { lsn: bigint; operation: 'INSERT' | 'DELETE'; tuple: { user: string; relation: string; object: string; }; timestamp: number; } export class EdgeReBACAuthorizer { private decisionCache = new Map<string, { allowed: boolean; lsn: bigint }>(); private currentWatermarkLsn: bigint = 0n; constructor(private readonly fgaClient: OpenFgaClient) {} /** * CDC Stream Consumer: Consumes transactional log events (e.g., via Kafka/Debezium). * Invalidates local keys and advances the local replica watermark deterministically. */ public handleCDCInvalidation(event: CDCInvalidationEvent): void { if (event.lsn <= this.currentWatermarkLsn) { return; // Deduplicate already processed transactional log offsets } const directKey = this.buildKey(event.tuple.user, event.tuple.relation, event.tuple.object); const wildcardKey = `idx:${event.tuple.object}`; // Invalidate direct decision key and associated object dependency graph keys this.decisionCache.delete(directKey); this.decisionCache.delete(wildcardKey); this.currentWatermarkLsn = event.lsn; } /** * Evaluates ReBAC check with Read-Your-Writes consistency. * Rejects cache hits if the client specifies a consistency token (LSN) higher than local edge state. */ public async check( user: string, relation: string, object: string, requiredLsn?: bigint ): Promise<boolean> { // If client requires a state strictly newer than our CDC watermark, bypass cache or await catchup const isLocalEdgeCaughtUp = !requiredLsn || this.currentWatermarkLsn >= requiredLsn; const cacheKey = this.buildKey(user, relation, object); if (isLocalEdgeCaughtUp && this.decisionCache.has(cacheKey)) { const entry = this.decisionCache.get(cacheKey)!; if (!requiredLsn || entry.lsn >= requiredLsn) { return entry.allowed; } } // Fetch authoritative check from OpenFGA with contextual transaction snapshot const response = await this.fgaClient.check({ user, relation, object, }); const isAllowed = !!response.allowed; if (isLocalEdgeCaughtUp) { this.decisionCache.set(cacheKey, { allowed: isAllowed, lsn: this.currentWatermarkLsn, }); } return isAllowed; } private buildKey(user: string, relation: string, object: string): string { return `fga:${user}#${relation}@${object}`; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Transactional CDC-Driven ReBAC Cache Invalidation Standard

Transactional CDC-Driven ReBAC Cache Invalidation Standard defines an industrial-grade behavioral standard for security engineering. Enforces deterministic, transactional log-driven cache invalidation across distributed edge Policy Decision Points (PDPs) during OpenFGA relationship tuple mutations. Eliminates authorization latency skew and the window of vulnerability inherent in dual-write caching by binding edge cache freshness directly to database write-ahead logs (WAL). Guarantees immediate revocation propagation and prevents stale authorization decisions across globally distributed edge nodes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Dual-Write Cache Eviction and Unsynchronized TTLs for ReBAC Decision Caching Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Dual-Write Cache Eviction and Unsynchronized TTLs for ReBAC Decision Caching	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS ingest relationship tuple mutations via an ordered Change Data Capture (CDC) stream (e.g., Debezium, Kafka, Postgres WAL) rather than executing direct dual-writes to distributed caches.

Engineers MUST ALWAYS ingest relationship tuple mutations via an ordered Change Data Capture (CDC) stream (e.g., Debezium, Kafka, Postgres WAL) rather than executing direct dual-writes to distributed caches.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.