{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-24T21:56:24.175Z",
  "record_id": "VXI-EXT-PROCUREMENT-OPENFGA-CACHED-CHECK-AFTER-TUPLE-CHANGE-01-v1",
  "record_kind": "external_reference",
  "title": "OpenFGA authorization cache freshness",
  "system": "OpenFGA",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Can a successful OpenFGA tuple update be followed by a stale Check response?",
  "near_questions": [
    "Can OpenFGA return an old permission result after a tuple write?",
    "What does HIGHER_CONSISTENCY bypass in OpenFGA?",
    "Does MINIMIZE_LATENCY always mean cached authorization?",
    "Which evidence distinguishes a fresh FGA check from a cached result?"
  ],
  "supported_claims": [
    {
      "claim": "The pinned consistency guide says MINIMIZE_LATENCY can use cached results, so an immediate check may omit a recent tuple change when caching is enabled. HIGHER_CONSISTENCY bypasses the cache and queries the database. Caching is documented as disabled by default. The actual configuration and request mode matter; a write receipt alone does not establish a fresh authorization decision.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Cache deployment and downstream enforcement are unobserved.",
    "Authentication or a policy result does not establish business approval, safe tool behaviour or completed execution.",
    "Buyer deployment testing, live runtime enforcement, certification or permission to act",
    "Expanded capabilities or licences for existing INDEX executables"
  ],
  "public_summary": "The pinned consistency guide says MINIMIZE_LATENCY can use cached results, so an immediate check may omit a recent tuple change when caching is enabled. HIGHER_CONSISTENCY bypasses the cache and queries the database. Caching is documented as disabled by default. The actual configuration and request mode matter; a write receipt alone does not establish a fresh authorization decision.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Query Consistency Modes",
    "source_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/consistency.mdx",
    "checked_on": "2026-10-24",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-OPENFGA-CACHED-CHECK-AFTER-TUPLE-CHANGE-01-v1",
    "candidate_record_sha256": "53c55a4258bde259a5e02d66c9df28ad3c8485a5332bf2d8aed9f61d87a6f9bf",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The pinned consistency guide says MINIMIZE_LATENCY can use cached results, so an immediate check may omit a recent tuple change when caching is enabled. HIGHER_CONSISTENCY bypasses the cache and queries the database. Caching is documented as disabled by default. The actual configuration and request mode matter; a write receipt alone does not establish a fresh authorization decision.",
    "required_buyer_context": "Tuple write time and check consistency mode; Cache configuration and application decision time; Application enforcement point and downstream access observations. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-24",
    "claim_to_check": "Can a successful OpenFGA tuple update be followed by a stale Check response?",
    "documented_statement": {
      "status": "documented",
      "statement": "The pinned consistency guide says MINIMIZE_LATENCY can use cached results, so an immediate check may omit a recent tuple change when caching is enabled. HIGHER_CONSISTENCY bypasses the cache and queries the database. Caching is documented as disabled by default. The actual configuration and request mode matter; a write receipt alone does not establish a fresh authorization decision.",
      "source_ids": [
        "fga-consistency"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Decide whether a grant or revocation has been reflected in the check used for an action. This is a source-based review decision, not an observed deployment result.",
      "source_ids": [
        "fga-consistency"
      ]
    },
    "buyer_evidence_required": [
      "Tuple write time and check consistency mode",
      "Cache configuration and application decision time",
      "Application enforcement point and downstream access observations"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not infer immediate effective revocation from a write receipt and a potentially cached check."
    },
    "unknowns": "Cache deployment and downstream enforcement are unobserved.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "Cache deployment and downstream enforcement are unobserved."
    },
    "evidence_sources": [
      {
        "source_id": "fga-consistency",
        "url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/consistency.mdx",
        "final_url": "https://raw.githubusercontent.com/openfga/openfga.dev/fb5359796e1e1027985675cfdd2413e6dcbfdf5d/docs/content/interacting/consistency.mdx",
        "status": 200,
        "captured_at_utc": "2026-10-24T21:45:01.937Z",
        "sha256": "faec3c4c1b36c2c8af6de99ec145bb76d181fe3620791e225ad4760aed3efd61",
        "bytes": 8951,
        "title": "Query Consistency Modes",
        "hash_basis": "Decoded HTTP response body bytes",
        "rights_review": "Original factual paraphrase and source metadata only; Apache-2.0 repository captures retained privately and not redistributed.",
        "checked_on": "2026-10-24",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "Background",
          "Cache expiration"
        ],
        "version_context": "Pinned openfga/openfga.dev revision fb5359796e1e1027985675cfdd2413e6dcbfdf5d captured 2026-10-24. Documentation review, not evidence that a buyer implementation conforms."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Documentation review only; the buyer must establish applicability and actual outcomes. INDEX does not inspect or control the deployment.",
    "paid_value": {
      "decision_context": "Decide whether a grant or revocation has been reflected in the check used for an action.",
      "free": "Complete review, sources, practical questions and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck the pinned source, actual implementation version, policy inputs and retained decision evidence before relying on a current outcome."
    },
    "buyer_relevance": "Decide whether a grant or revocation has been reflected in the check used for an action.",
    "refusal_conditions": [
      "Do not infer immediate effective revocation from a write receipt and a potentially cached check."
    ]
  },
  "niche": {
    "niche_id": "agent-authority-action-evidence",
    "label": "Agent Authority & Action Evidence",
    "classification_id": "identity",
    "classification_label": "Agent Identity, Credentials & Delegation",
    "topic_id": "identity",
    "buyer_intent": "Decide whether a grant or revocation has been reflected in the check used for an action.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#openfga-cached-check-after-tuple-change",
  "machine_readable_record": "/varexis-index/records/openfga-cached-check-after-tuple-change.json"
}