Entitlement Is Not Authorization

Subscription software must answer one question on every request:
may this user do this, now? Production systems usually treat the answer as
authoritative state, read at request time, and assume that stronger consistency
is always safer.
We systematize what is publicly known about entitlement correct-
ness when billing truth is owned externally, and ask whether the consistency-
token protocols of internal authorization transfer to it.
Method. A multivocal review of 85 sources, two propositions, an error-cost
model, TLC model checking, and a seeded simulation of 20,000 subscribers
replicated across ten seeds.
No Zanzibar-style token can exist for entitlement, because external
billers share neither a write path nor a clock; staleness bounded by the recon-
ciliation interval is achievable instead. In simulation the projection dominates:
applying revocations at their effective time rather than on arrival cuts expected
cost 27-fold, more than every freshness parameter combined. Under partition,
serving the last snapshot dominates; failing open beats failing closed for sub-
scribers whenever the cost ratio ρ of false denial to over-service exceeds about
0.35, but the break-even reaches 26 when 5% of users pay. A revocation hold-
over pays only against spurious revocations, never beyond the reconciliation
interval, and daily reconciliation makes error nearly insensitive to notification
loss.
Entitlement should be engineered as an eventually consistent
derived view with an effective-time projection, per-class staleness bounds, and
reconciliation as its source of truth. We contribute a vocabulary, six invariants,
a reference architecture, a model-checked specification, and an open simulator.

• Software engineering