The revocation step raises a useful edge case: what happens to a write that was authorized but is still queued when access is revoked? I would want the worker to recheck authority before committing, and the audit trail to distinguish requested, authorized and completed. Would you put that boundary in each business API, or in the session layer you describe?