On the CQRS+ES project I worked on for two years, we were just thinking about the happy path at first before realizing that was a mistake. For your example, he

On the CQRS+ES project I worked on for two years, we were just thinking about the happy path at first before realizing that was a mistake. For your example, here are two approaches depending on your implementation and your tolerance for edge cases and eventual consistency: - you can enter into a saga which would do a two phase commit, ensuring that the user is indeed authorized when the edit is made. All possible states are captured in your event model and so your event history will always show what has happened - you can load the document aggregate when you process the command and query it at that time, throwing an exception if the user is not authorized and then you can notify the user or send another command. In this case, your event model does not have to include events that describe the violation of domain rules The first option gives you the guarantee you are looking for, but comes at the cost of complexity. The second option will give you the correct results unless a user is deauthorized before the edit command completes. Some systems process all commands in serial and so it would not be a problem. Some systems partition their commands to distribute the work and so this edge case can occur. But you can select what makes most sense for you.