When Authorization Changes Before Execution, Who Is Responsible for Validating Authority?

Thanks, Jamony. I agree with the distinction between identity validation and the resource API's final authorization decision.

Your point about loading current resource state is particularly relevant. I think there is another boundary worth examining: what happens when the resource state changes after AuthorizeAsync evaluates the operation but before the application performs the actual write?

For example, if the resource version, ownership, reporting relationship, or relevant business attributes change during that interval, should the application bind the authorization decision to the resource version it evaluated and reject execution if that version has changed?

I'm interested in whether resource-based authorization is typically combined with optimistic concurrency or another execution-time consistency mechanism to close that gap.

Thanks for the practical implementation perspective.