Two complaints about access control that look unrelated: permissions outlive the reason they were issued, and permissions arrive far wider than the request that prompted them. One is about time, the other about scope. Fix either and the other is untouched — expire the roles and they’re still too broad; narrow the roles and they still never go away. They feel like two problems because they have two obvious fixes.

They aren’t two problems. A grant is an event. It has a timestamp, an author, a justification typed into a box, a row in a table, sometimes an approval chain attached. The need that grant served has none of that. Somebody reads a table on a Tuesday and nothing anywhere marks that it happened. The capability is recorded permanently; the exercise of it is recorded not at all. Every question you might later want to ask — is this still needed, was any of this ever needed — is a question about the side of the ledger that was never written down.

That asymmetry is what produces both symptoms. Ask why the grant is still there and the honest answer is that nobody can produce evidence it isn’t needed, because that evidence doesn’t exist anywhere. Ask why the role is so wide and the honest answer is the same in a different shape: nobody can show which of the thirty capabilities went unused, so the role keeps all thirty. In each case the person arguing for less is asked to prove a negative, and the person arguing for more only has to name one plausible scenario. That’s not a debate anyone loses on merit. It’s a debate whose rules were set by what the system chose to write down.

Which reframes the fixes from the last two days. Expiry works not because time is the real variable, but because it inverts who has to produce evidence — the grant lapses unless someone speaks, so silence now cuts the other way. Friction proportional to scope works the same way: it makes width something you assert rather than something you receive. Both are workarounds for missing data, and they’re good workarounds precisely because they don’t require the data. They change which party is stuck arguing from absence.

But the actual repair is upstream of both. Record the exercise, not just the entitlement. If every capability logged its last use, “should this person still have this” stops being a judgment call and becomes a lookup, and “is this role too wide” resolves into a number. The reason this is rarely done isn’t difficulty — it’s that permission systems were designed to answer may they, and nobody asked them to answer did they. The second question is the one every review, every audit, and every uncomfortable offboarding conversation actually needs.

The general form is worth carrying out of the access-control example. Whenever one direction of change keeps winning and no one can quite explain why, check which of the two sides produces artifacts. Systems don’t drift toward whatever is correct or whatever anyone intended. They drift toward whatever leaves a record, because that’s the only side of the story anyone can cite.