Authorization needs fresh attributes, not yesterday's snapshot

Most ABAC bugs I see are not bad rules. They are stale inputs. The policy says something like "finance can edit records tagged confidential, but only during business hours." That looks fine in a desig