A cache temporarily reuses authorization signals so decisions do not repeatedly depend on upstream systems. It trades some freshness for lower latency and reduced load. section 12.4.1 section 12.4.2
Authorization systems can cache at the policy decision point (PDP), policy information point (PIP), edge, or client. Short time-to-live (TTL) values improve accuracy; long TTLs improve performance but increase stale-data risk. section 12.4.2
Choose cache placement and duration according to signal risk and change rate:
- Cache in a PDP to avoid repeated lookups, while maintaining careful invalidation logic. section 12.4.2
- Cache in a PIP to share context across PDPs, accepting a larger stale-cache blast radius. section 12.4.2
- Cache at the edge or client for offline or low-latency operation, especially with low-risk data; compromised devices increase exposure. section 12.4.2
- Assign different TTLs to signals: rapidly changing on-call status may last five minutes, while employment status may last 24 hours. section 12.4.2
Different TTLs for different signals
A PDP can reuse an employee’s on-call status for five minutes while retaining employment status for 24 hours, matching each cache duration to its change rate and stale-data risk. section 12.4.2
const onCall = await cache.getOrFetch(
`oncall:${employeeId}`,
{ ttl: "5m" },
() => pagerDuty.isOnCall(employeeId)
);
const employmentStatus = await cache.getOrFetch(
`employee:${employeeId}:status`,
{ ttl: "24h" },
() => hr.getEmploymentStatus(employeeId)
);
Shows signal-specific cache retrieval with separate five-minute and 24-hour TTLs. section 12.4.2
