Stale permission prevention at scale

Design the consistency guarantees for a distributed, heavily-cached authorization service where the dangerous bug is the 'new enemy' problem: Alice removes Bob's access to a document AND simultaneously adds sensitive content, but because permission checks are cached/replicated with lag, a stale check still says Bob can read, so Bob sees content he was just locked out of. The service answers ~2M checks/sec from caches and replicas across regions. Design how you prevent stale-permission leaks WITHOUT making every check a strongly-consistent cross-region read (which would blow latency). Discuss consistency tokens, causal ordering, and where you accept staleness vs where you must not.