Concurrency control
Recheck authority when a concurrent change affects permission
A valid session does not guarantee that the requested action remains permitted. Keep the access decision consistent with the state being changed.
In this article
Identify mutable authority
A user may be allowed to approve a request because they belong to a team, own the record or hold a current delegation. Another operation can change those facts while the approval is in progress.
Decide the policy for that overlap. Some workflows authorise at submission and create an organisation-owned job. Others require the requester to retain authority until execution. The system needs a deliberate rule rather than whichever check happens to run first.
Separate this question from session validity. A still-valid login can belong to a user whose role has changed.
Protect the relevant decision boundary
For an immediate database mutation, consider how the authority facts and target state are read and checked relative to the write. A check against a stale cached role followed by an unconditional update may violate the intended revocation behaviour.
Choose coordination appropriate to the data model. Do not claim that locking the target row also protects an unrelated membership record unless the protocol actually covers it.
Keep the transaction short and scoped. Stronger coordination should protect the specific policy without unnecessarily blocking unrelated users.
Handle queued work explicitly
Persist the authority mode of background work in trusted job data. A client must not be able to select a mode that bypasses later checks.
If the job rechecks current requester rights, define what happens when access has been revoked. Hold or reject the work with a visible outcome rather than retrying indefinitely as though permission were a transient network error.
If the job legitimately continues under organisation authority, retain the original authorisation evidence and ensure the service identity has only the scope required for that operation.
Test the race without disclosing data
Pause an operation after its initial access check, revoke the relevant permission and resume it. Assert the result required by the documented policy.
Inspect both the response and the stored effect. A final access-denied page does not undo a mutation that already happened.
Conflict diagnostics must also respect access. Returning the current record to help resolve an edit conflict is inappropriate if the caller has just lost permission to read it. Concurrency handling should preserve the same disclosure boundary as the normal request path.
Primary sources
OWASP: authorisation guidanceReferences checked 11 September 2026.