Auth Invariant Tester: Temporal Authorization Correctness Verification for Distributed Systems

Authorization is often modeled as a pure function from request context to an allow or deny decision. In production systems, however, authorization is implemented as a distributed process: decisions are cached, revocations propagate asynchronously, policies refresh periodically, and credentials such as JSON Web Tokens (JWTs) may outlive the policy state that originally justified them. These realities introduce security failures that are temporal in nature and therefore frequently invisible to conventional unit and integration testing. This paper presents Auth Invariant Tester, a reference-model-based verification framework for detecting temporal authorization safety violations. The framework executes authorization scenarios under controlled fault injection, records execution traces, and checks invariants that capture safety properties including revocation correctness, token invalidation, tenant isolation, and policy-version alignment via Policy Epoch Safety. Authorization behavior is compared against a synchronous reference authorizer that serves as an executable oracle. We evaluate three distinct authorization architectures under identical invariants: (1) a decision-cachebased RBAC system with delayed invalidation, (2) a stateless JWT system that snapshots roles into tokens, and (3) a policy-cached enforcement system that refreshes policy periodically. Across parameterized executions, violations arise conditionally, only when authorization checks intersect stale enforcement windows. Across 20 executions of buggy systems, the framework reports 4 critical violations, while corrected implementations produce 0 violations. These results demonstrate that temporal authorization failures are predictable consequences of performance and availability tradeoffs, and that executable invariants provide a practical, reproducible method to detect and eliminate them.