Jesse Murah
Your Fired Employee Still Has Access. Here’s Why.
Your access control works perfectly until it doesn't.
A contractor's contract ends. An employee is fired. You revoke their session, delete them from the database. But their JWT is still valid. Somewhere downstream, a payout just went through.This is the gap between "we revoked access" and "access is actually gone" and it lives in every system that uses JWTs for authorization, not just authentication.
We'll walk through why stateless tokens quietly fail when you use them to make permission decisions: the Revocation Problem, Scope Bloat, and the Microservice Predictability Problem. These converge in what Google's Zanzibar paper calls the New Enemy Problem — a user whose access has been revoked retains it because the token is still valid.Then we fix it using a demo, we'll wire up OpenFGA — an open-source Relationship-Based Access Control engine based on the Zanzibar model and show what happens when you revoke access in a system that actually knows the difference between authentication and authorization.
You'll leave with a clear mental model of where JWT authorization breaks down, what ReBAC gives you instead, and what to look for in your own codebase.