Access was revoked. Should an existing download link still work?

Define what “stop downloads” actually commits you to

Start the request record with the symptom, objective, scope and evidence you will examine after release. Removing a role from a management screen is only one change. The product decision is which person must lose access to which files, from what point onward.

Fix the before-change reproduction: request an export at09:55, then issue a direct URL for the completed report at09:59. Its30-minute lifetime ends at10:29. An administrator commits revocation at10:00; the still-signed-in member opens the URL at10:01. The URL is still valid: that is the behavior to change. Preserve login and unrelated work.

Agree on already-authorized transfers and saved copies separately. This example allows a transfer authorized before commitment to finish and makes no promise to recall downloaded copies. A requirement to interrupt active transfers would add transfer-session control to the design.

Map routes that the current screen does not show

Ask engineering for the actual destination used by lists, detail pages, old email, notifications, generation jobs and resumed downloads. Put each delivery route beside the place where permission is checked. Mark unverified paths as open questions rather than quietly treating them as covered.

AWS documents that an S3 presigned URL uses its issuer’s credentials. In our example, those belong to a shared service identity. Changing a member’s application role is therefore not the same operation as revoking the signing credentials. That is the reason to inspect the path beyond the role editor.

Why shortening the link lifetime is not the chosen answer

Compare shortening the lifetime from30 to five minutes. A URL issued at09:59 expires at10:29 or10:04 respectively. Both remain valid at10:01, after revocation at10:00. The shorter URL therefore still fails the immediate-revocation objective in this example. These are fictional comparison inputs, not recommended security thresholds.

Choose an application-mediated transfer for this requirement: check current permission, then stream the file. Redirecting the browser to a direct storage URL after the check would reintroduce a route that later requests can use without the application check. Engineering must validate capacity and transfer cost. If that design is impractical, renegotiate the immediate-revocation promise explicitly.

Write the authorization condition before drawing the button

OWASP distinguishes authentication from authorization and recommends checking permission on each request. Here, require a valid session, current team membership, effective permission for this file, an available file and a successful permission lookup. Removing one role does not deny access if another valid role still grants the same permission.

Replace “updates immediately” with an ordering contract. The permission store must give revocation commitment and transfer authorization a consistent order. New authorization decisions after commitment must not rely on a stale replica or cache. If the lookup fails, send no file and return a distinct lookup-failure state.

Separate the states behind an unavailable download

Record state, copy, available action and recheck point together. An expired session needs a login route. A signed-in member whose permission was revoked should not be sent through an endless login loop. Do not append a protected filename or storage address to an unauthorized response.

Jobs need the same treatment. Recheck before starting generation. If revocation occurs during generation, completion must not register a result as available to that member or send a download notification. Store generation completion separately from access permission; do not delete a shared file needed by other authorized people.

A new route does not retire the old links

The rollout plan must stop issuance of direct links and replace entry points with mediated routes. Inventory already-issued links, their validity conditions, maximum remaining lifetime, old email and cache paths. Until old routes stop delivering files, do not label the entire migration complete.

If immediate cutover is required, storage and security owners must choose how to invalidate existing access and assess collateral impact. If they choose to wait for expiry, document the interval in which old links can still work. Those two choices are different operational states.

MDN explains that no-store does not erase an already stored response. Specify the new download response policy, upstream cache handling and saved-copy limitations separately. Audit decisions with time, an internal file reference, outcome and policy version; omit file contents and token-bearing direct URLs.

Ask AI to find missing paths, not invent your policy

Give AI the settled scope and public constraints. Ask it to inspect missing conditions across the delivery routes. The prompt below is an example for future use. Compare any returned suggestion with the request objective, state specification and QA expectations.

If a hypothetical suggestion says to end every session, ask for a revision that preserves unrelated work. If it says clearing a cache recalls a saved file, reject that claim. Record what you accepted, the revised wording, deferred decisions and their engineering owner. These hypothetical responses are not a transcript of an AI run.

Review this fictional team-library download-permission change.
An export is requested at 09:55. Revocation is committed at 10:00. The member uses an old link at 10:01. Login and unrelated work permissions remain valid. The chosen design streams through the authenticated application, without exposing a direct storage URL to the browser.
Find missing conditions across lists, old email, generation jobs, transfers and retries. Do not invent database fields or unverified APIs.
Acceptance: new authorization decisions after revocation deny access when no effective permission remains; a transfer authorized before commitment may finish; resumption is a new request. Another valid role is evaluated as part of effective permission. Already saved copies cannot be recalled by this design.
Return: missing condition / affected screen or action / revised sentence / reproduction steps and expected result. Separate confirmed decisions from engineering questions.
Test context: before migration, a direct URL issued09:59 expires10:29 at30 minutes or10:04 atfive minutes; both work at10:01. After completed migration, test application reauthorization and blocked retained direct URLs separately. Queued-job cases are alternative scenarios.

Test beyond refreshing the screen after revocation

Record before-change and completed-migration tests separately. Before the change, reproduce access at10:01 using a direct URL issued at09:59. After migration, repeat the relative timing using an application URL to test fresh authorization, and separately check that a retained old direct URL no longer returns bytes. Passing the new route does not prove outstanding direct URLs are blocked.

Prepare two test accounts and fictional files in different teams. Capture the time when revocation commits separately from the transfer-authorization time. Check the actual file response, not just whether the button is hidden.

The table states acceptance criteria, not completed integration results. Before release, reproduce overlapping authorization and revocation, requests on different application nodes, cache reuse and resumed transfers against the implementation. Attach results and evidence locations to the QA handoff.

Hand over the decision and the completion evidence

Planning owns the timing promise, exceptions and copy. Engineering maps the permission store and delivery paths to the specification. QA covers old addresses and concurrent requests. Operations checks what the revocation notice actually promises. Assign owners and decision dates for retention, capacity and in-flight policy; do not call those unresolved areas complete.

After release, examine files served to new requests without effective permission after committed revocation, legitimate access blocked by lookup failures, repeat support questions and transfer failures separately. Use the necessary decision records without expanding personal-data collection. A higher denial count alone is not evidence of a better product.

Issue: revoking downloads in a fictional team library
Problem: hiding the button can leave email links, direct URLs and generation jobs intact.
Objective: evaluate new download requests after committed revocation against current effective permission. Preserve login and unrelated work.
Scope: the team library and the new mediated download route. Recalling already saved copies is excluded.
Choice: verify session, team, file access, effective download permission, file availability and a successful authorization lookup on every new request. Stream through the application without exposing direct storage URLs.
Concurrency: establish a consistent order between committed revocation and the transfer-authorization decision using consistent permission state. Deny new decisions after commitment when no effective permission remains. Transfers authorized earlier may finish. Retries and range resumption require a new decision. Lookup failure never grants access.
Jobs and notifications: recheck before execution, result registration and notification delivery. A revoked member receives neither an available result nor a download notification. Generation completion and access authorization are separate states.
Migration: stop issuing direct links; inventory their validity conditions, remaining lifetime and cache routes. Do not claim full cutover until the old delivery routes stop serving files.
UI: distinguish login required, access unavailable and authorization lookup failed. Do not disclose protected filenames or storage addresses in unauthorized responses. Revocation does not mean deleting the file.
Ownership: planning defines timing, exceptions and copy; engineering maps delivery paths, consistency and caches; QA reproduces old-link and concurrent requests; operations checks notices and audit records.
Before release: test direct-route bypass, other-team files, multiple roles, queued jobs, revocation before completion, resumption and lookup outage. Obtain owner decisions on retention, transfer capacity and in-flight behavior.
Completion evidence: design table, decision rationale, API and screen results, legacy-route shutdown checks and handoff record. This is a worked fictional design.
Timing and rollout checks: before migration, a direct URL issued09:59 expires10:29 at30 minutes or10:04 atfive minutes and remains valid at10:01. After migration, repeat the relative timing to test denial on the application URL and separately verify no body from retained old direct URLs. Do not mark transitional state as complete.

Sources and example conditions

This fictional library design uses AWS, OWASP and MDN documentation checked on 2026-09-26. Times, link lifetimes, mediation and in-flight behavior are example decisions. It contains no company records, claimed personal work history or measured business outcome. AI prompts and hypothetical responses are examples, not executed conversations. Document consistency and page checks do not establish real authorization/storage integration. English and Chinese localize the same Korean case.

AWS — Download and upload objects with presigned URLs

OWASP — Authorization Cheat Sheet

MDN — HTTP caching