[authorization]

2026-08-27[writing]

I tried to write down the formula for revocation latency and it kept being wrong in instructive ways. The corrections come from validator source code: a five-minute grace on expired tokens in .NET, streams that outlive their token by design, and a 12-hour JWKS refresh on the one lever that actually works. With runnable experiments.