Some parties (including myself at one point in the past) block with low cost. Suppose you're a microservice that does caching, fast-track authentication or sim

Some parties (including myself at one point in the past) block with low cost. Suppose you're a microservice that does caching, fast-track authentication or similar. If you block a user, that user will have to spend several or even many seconds on reauthentication and/or cache refreshing, but that's the whole cost. Is your proper threshold for blocking high or low?