Make work flow.

1. Verify document access with an active role.
2. Retain the existing revoked-role check in a fresh session.
3. Prime the cache, revoke the role, then request again in the same session. Expect denial under AC3.
4. Clarify next-request denial versus five-minute cached access.

Grounded in S1 · AC3, S3 · cache, and S4 · shown tests.

Synthetic users and document; the revocation actor is authorized. No credentials.

{
  "task": "DEMO-218",
  "user": {
    "id": "demo-member",
    "role": "active"
  },
  "revocationActor": {
    "id": "demo-admin",
    "canRevokeRoles": true
  },
  "document": {
    "id": "demo-document"
  },
  "session": {
    "id": "demo-session",
    "userId": "demo-member",
    "cachePrimed": true
  }
}

Illustrative helper assumptions: activeUserFixture provides an active user, one session, a document and an authorized revocation actor; canAccess returns a boolean; revokeRole completes the authorized role change. Adapt helpers to the real suite.

test('cached access is denied after role revocation', async () => {
  const { user, session, document, revocationActor } =
    await activeUserFixture();

  // Prime the cache with allowed access in this session.
  expect(await canAccess(session, document)).toBe(true);

  await revokeRole(revocationActor, user);

  // AC3: the next request in the same session is denied.
  expect(await canAccess(session, document)).toBe(false);
});

Source: S1 · AC3, S3 · cache, S4 · existing test style. This adds a transition check alongside the existing AC2 check. No test was run.