When Does Authorization End? Effect Closure at Provider Boundaries
When does a permission actually stop working, even after you revoke it?
When you revoke someone's permission to do something, that permission might still let them act through work already in progress—even after the revocation succeeds. Researchers built a tool called EFFECTBOUND that can check whether a system truly blocks all these hidden paths, and found real vulnerabilities in GitHub, Kubernetes, NATS, and Kafka where revoked permissions could still take effect.
Permission systems are the backbone of security in cloud platforms and distributed software. If revoking access doesn't actually stop all paths to action—like a merge happening with the wrong code, or a message publishing after removal—attackers can exploit the gap between when you think something is locked down and when it actually is. The fixes tested on Kafka show that proper closure checking can block these risks without slowing down legitimate operations.