Zero-Stale ReBAC Cache Invalidation with CDC & Consistency Tokens

--- description: Zero-Stale ReBAC Cache Invalidation with CDC & Consistency Tokens - Enforces zero-stale authorization evaluations in OpenFGA ReBAC architectures operating under sub-10ms SLOs. Mandates deterministic CDC invalidation pipelines and consistency token propagation across collaborative permission mutations to eliminate privilege retention vulnerabilities caused by replication lag and uncoordinated caches. globs: src/auth/**/*.{ts,tsx}, src/services/**/*.{ts,tsx}, src/cdc/**/*.{ts,tsx}, src/lib/openfga/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/openfga-rebac-cdc-invalidation-pipeline" --- # Zero-Stale ReBAC Cache Invalidation with CDC & Consistency Tokens > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Uncoordinated TTL Caching and Blind Tuple Writes Permitting Stale Permission Bypasses ## System Constraints You are a Principal Security Architect enforcing strict relation-based access control (ReBAC) invariants using OpenFGA. You must prevent stale-read authorization bypasses during collaborative permission updates. Mandate transactional outbox or CDC-driven invalidation events, consistency tokens (Zanzibar zookies) on write-path mutations, and contextual evaluation parameters to guarantee sub-10ms decisions without compromising authorization freshness. ## Strict Guidelines - Engineers MUST ALWAYS return and propagate an incremental or transaction-backed consistency token (Zookie/snapshot token) from OpenFGA write mutations to client sessions and downstream services. - Engineers MUST NOT rely on uncoordinated, pure time-to-live (TTL) cache invalidation for authorization checks involving privilege revocations or role demotions. - Services MUST publish tuple mutation events through an atomic Change-Data-Capture (CDC) or Transactional Outbox pattern before acknowledging permission updates to clients. - Authorization check calls SHOULD pass the latest known consistency token (e.g., using `consistency: 'HIGHER_CONSISTENCY'` or snapshot tokens) when evaluating mutations initiated within the current request thread or session boundary. - Distributed cache layers (e.g., Redis or in-process L1 caches) MUST listen to real-time CDC invalidation topics and evict impacted subject-relation-object graphs atomically before returning cached verdicts. ## Bad vs Good Implementations ### Naive OpenFGA Check with Blind TTL Caching vs. CDC-Backed Snapshot Token Invalidation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Revocation mutations write directly to OpenFGA without invalidating the L2 Redis cache. Active sessions read stale positive checks for up to 300 seconds, enabling unauthorized data access post-revocation. ```typescript import { OpenFgaClient } from '@openfga/sdk'; import { createClient } from 'redis'; const fga = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL! }); const redis = createClient(); // VULNERABLE: Blind TTL caching on relation checks with uncoordinated writes export async function checkAccess(userId: string, relation: string, documentId: string): Promise<boolean> { const cacheKey = `fga:${userId}:${relation}:${documentId}`; const cached = await redis.get(cacheKey); if (cached !== null) { return cached === 'true'; } const { allowed } = await fga.check({ user: `user:${userId}`, relation, object: `document:${documentId}`, }); // Stale authorization vulnerability: Revocation won't invalidate this key for 5 minutes await redis.setEx(cacheKey, 300, String(allowed)); return !!allowed; } export async function revokeAccess(userId: string, relation: string, documentId: string): Promise<void> { // Anti-pattern: Writes directly to FGA without invalidating distributed caches or emitting CDC events await fga.write({ deletes: [{ user: `user:${userId}`, relation, object: `document:${documentId}`, }], }); } ``` #### Production Standard (Correct) > **Standard**: Bypasses stale reads by using consistency preferences when tokens are supplied, aggressively invalidates Redis keys on write mutations, and emits CDC invalidation events across all edge nodes. ```typescript import { OpenFgaClient, ConsistencyPreference } from '@openfga/sdk'; import { RedisClientType } from 'redis'; interface AuthorizationContext { userId: string; relation: string; documentId: string; minConsistencyToken?: string; } export class ResilientAuthorizationService { constructor( private readonly fga: OpenFgaClient, private readonly redis: RedisClientType, private readonly cdcPublisher: { publish: (event: object) => Promise<void> } ) {} public async checkAccess(ctx: AuthorizationContext): Promise<boolean> { const cacheKey = `fga:cache:${ctx.userId}:${ctx.relation}:${ctx.documentId}`; // If a recent mutation occurred in this session, bypass L2 cache or require snapshot consistency if (!ctx.minConsistencyToken) { const cached = await this.redis.get(cacheKey); if (cached !== null) { return cached === 'true'; } } const response = await this.fga.check( { user: `user:${ctx.userId}`, relation: ctx.relation, object: `document:${ctx.documentId}`, }, { consistency: ctx.minConsistencyToken ? ConsistencyPreference.HigherConsistency : ConsistencyPreference.MinimizeLatency, } ); const allowed = !!response.allowed; // Short cache with strict tag attribution for CDC-targeted invalidation await this.redis.set(cacheKey, String(allowed), { EX: 15 }); return allowed; } public async revokeAccess(userId: string, relation: string, documentId: string): Promise<{ token: string }> { const tupleKey = { user: `user:${userId}`, relation, object: `document:${documentId}` }; // Execute write and capture resulting state snapshot const result = await this.fga.write({ deletes: [tupleKey], }); // Publish immediate invalidation message through transactional CDC pipeline await this.cdcPublisher.publish({ type: 'TUPLE_DELETED', tuple: tupleKey, timestamp: Date.now(), }); // Explicitly invalidate node cache on write path const cacheKey = `fga:cache:${userId}:${relation}:${documentId}`; await this.redis.del(cacheKey); // Return write confirmation token to enforce read-your-writes snapshot consistency return { token: result.writes?.[0]?.user || 'revoked' }; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Zero-Stale ReBAC Cache Invalidation with CDC & Consistency Tokens

Zero-Stale ReBAC Cache Invalidation with CDC & Consistency Tokens defines an industrial-grade behavioral standard for security engineering. Enforces zero-stale authorization evaluations in OpenFGA ReBAC architectures operating under sub-10ms SLOs. Mandates deterministic CDC invalidation pipelines and consistency token propagation across collaborative permission mutations to eliminate privilege retention vulnerabilities caused by replication lag and uncoordinated caches. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Uncoordinated TTL Caching and Blind Tuple Writes Permitting Stale Permission Bypasses Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Uncoordinated TTL Caching and Blind Tuple Writes Permitting Stale Permission Bypasses	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS return and propagate an incremental or transaction-backed consistency token (Zookie/snapshot token) from OpenFGA write mutations to client sessions and downstream services.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.