Time zone scheduling
A queued schedule should not preserve revoked authority by accident
Scheduled work can run long after a user creates it. Define whether execution uses current requester rights or an explicitly authorised organisation process.
In this article
Decide who owns the scheduled action
A personal reminder and an organisation's required reconciliation job have different authority models. The first may need the user's current access, while the second may legitimately continue under a service-owned process.
Record that policy in trusted schedule configuration. A client should not be able to choose a mode that bypasses later permission checks.
Keep the target tenant, resource and action explicit.
Validate edits and cancellation
Check who may change the local time, destination, recurrence and enabled state. A schedule edit can redirect data or trigger a consequential operation at a different time.
Protect occurrence lookup and cancellation with the same tenant boundary. Knowing an occurrence identifier should not allow another user to stop or inspect it.
Record meaningful changes with actor and schedule version, without unnecessary sensitive payloads.
Recheck at execution where required
Before producing the effect, verify that the occurrence remains active and authorised under its policy. A user may have lost access or the schedule may have been cancelled after queueing.
Do not assume the queue itself grants permission. The worker needs trusted context and a supported way to establish current authority.
For organisation-owned work, verify the service identity's scope and the original authorisation record as required by the process.
Test the delayed boundary
Pause a synthetic occurrence, revoke the relevant user's access or cancel the schedule, then resume it. Assert the intended outcome and inspect actual mutations.
Include an edit that changes the recipient of a report. A stale queued occurrence should not send data to an obsolete destination if the policy requires the edit to take effect immediately.
The review should establish who can create, alter and execute scheduled work over time. Correct timezone arithmetic does not make a delayed action authorised.
Primary sources
OWASP: authorisation guidanceReferences checked 11 September 2026.