Revoked membership survives a cache
Why it happens
Authorization cache has not observed the revocation.
Potential bug
A removed user reads tenant data.
Mitigation
Use short TTL plus membership epoch/invalidation and reauthorize sensitive object reads.