Paid media CDN authorization

Design secure content delivery for paid media (e.g., premium audio/video or paid downloads) over a CDN where files are cached at the edge for performance, but access must be restricted to entitled, paying users and must respect geo/license restrictions. The challenge: the edge serves cached bytes without calling your origin, so how do you enforce per-user authorization on a cached object without killing cache efficiency?