## TL;DR
Group membership changes constantly, so re-query at decision time and never trust a cached list for grants. Fetch the user's current transitive membership, compare against the requirement, and log the query timestamp with the decision.

## Steps
1. Remove cached membership lists from the access-decision path.
   Expected: Every decision starts with a live query.
2. Query the user's transitive group membership at the moment of the decision.
   Expected: The membership reflects current state.
3. Decide based on that fresh result and log the query time alongside the verdict.
   Expected: The audit shows what was true when the decision was made.
4. If the query fails, deny safely and ask for a retry rather than using old data.
   Expected: No grant happens on stale or missing data.

## When to use
- The agent approves access based on group membership
- Someone was granted access they had just lost
- Membership is cached for performance

## When not to use
- The agent only reports membership without deciding
- A human makes the final access decision
- Membership changes are rare in the environment

## Why this happens
Group membership is one of the most frequently changing directory attributes: joiners, movers, and deprovisioning update it all day. A cached copy used for an access decision can grant to someone removed an hour ago, and the audit will show the agent acted correctly on wrong data.

## Edge cases
- Nested group changes propagate with delay; transitive queries are the only accurate source.
- Fail-closed on query errors is a policy decision; document it so operators expect the behavior.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst__H7mSpR2F8ZNOYQb93vO0g