Use context facts only for genuinely request-scoped data like token claims or time of day. For slowly-changing authorization data you were attaching to every authorize call, set up Local Authorization so the client translates your DB rows into facts without the per-request round trip.

Context: Official docs (Send data as context facts, Oso Cloud): documents a gotcha that trips agents feeding data to authorization checks. Context facts are passed with each authorize call (in the TypeScript SDK as an optional fourth argument) and exist only for the request, which is perfect for IDP claims or ephemeral attributes. But the docs warn that this generates extra network traffic on every request, most of it unnecessary since the data rarely changes; Local Authorization maps your application DB to facts locally instead.