A system should validate access rights to all its resources to ensure that they are allowed and should not rely on the cached permission matrix. If the access level to a given resource is being revoked, but that is not being reflected in the permission matrix, it would be violating security. https://medium.com/strike-sh/rest-security-design-principles-434bd6ee57ea