What identity and access forbid

You cannot have stateless verification and immediate revocation.
You cannot enforce above the narrowest waist through which the data can be reached.
You cannot keep authorization context across an asynchronous boundary without deciding again at execution time.
You cannot enumerate effective access under a policy language expressive enough to describe real policy.
You cannot express exceptions with an allow-only model, nor have order-independent combination with denies.
You cannot limit inference with cell-level access control, however fine the granularity.

The escapes and their prices

Escape	Buys	Pays
Short TTL instead of revocation	stateless verification	the issuer is on the hot path; load = rate × TTL
Vended scoped credentials	narrow waist at storage; direct-access hole closed	availability coupling; total compromise if the vendor falls
Predicate-based row/column security	one coherent table, auditable policy	lost pruning, constrained plans, leak channels
Roles	enumerable, auditable access	explodes when policy is not low-rank
Attributes / relations	expresses real policy compactly	the inverse query becomes unanswerable
Capability passing	no confused deputy; survives async	revocation only by expiry; audit by request, not principal
Physical table split	enforcement needs no engine cooperation	N-times maintenance; policy hidden in pipeline code

Case, resolvedConstructed case · Mateus at Hollis Health

Every region visible through the files

Mateus's notebook, given storage credentials for speed, could list files outside his region, his Northern-only query scanned 40 TB, his team kept 14 forgotten grants, and a shared service account hid who asked for what. Where it started: Enforcement points →

Direct file access. Wei removes the storage credentials from the notebook. The engine now asks the catalog for a vended credential per query: 15 minutes, only the Northern partitions of visits, only that storage account. Mateus reads the same data and no more. The narrow waist is at storage.

The 40 TB scan. She re-partitions visits by region, so the security predicate region = 'North' matches the partition key. Files for other regions are skipped, and the scan falls to about 2 TB: the predicate must line up with the layout. The nightly cost of his queries drops accordingly.

The 14 old grants. She sets an expiry of 90 days on every grant by default, with a quarterly re-attestation. A grant that nobody renews disappears. She notes that this will break some jobs once, and agrees with Ingrid to accept that cost, because the alternative is the default drift.

The shared service account. Each pipeline gets its own service principal, scoped to its own tables, and the requesting person is stored in the job's metadata. This is only a partial fix (the asynchronous gap remains), and she writes that down. Data can still be exported by an authorized user, so she adds a row cap and an export log for notebooks.