Mobile and desktop clients often queue mutations while the network is down. The app checks edit permission when the user taps Save, stores the change locally, and later POSTs the batch when connectivity returns. That later POST usually trusts the queued payload and the still-valid session cookie. It does not ask whether the user may still edit that record.
Jordan drafts a contract amendment on a plane. While they are offline, an admin removes Jordan from the deal room. The flight lands, the client reconnects, and the queued update succeeds. The audit log shows Jordan as the editor hours after their access ended.
Authorize every queued mutation again at apply time, against the live policy for that user and record. If the check fails, leave the item in a conflict or rejected state instead of writing it. Do the same for conflict-resolution merges that run on the server, because a merge is still a write. Expire or discard queued writes when the session that created them is revoked.
To test it, grant edit on a record, put the client offline, queue an update, revoke edit (or remove the user from the space), bring the client online, and confirm the queued write is rejected and the record is unchanged.
