Could you write your permission changes/rollback logic to be idempotent? In this case you could always push the changes to completion, and reason about whether

Could you write your permission changes/rollback logic to be idempotent? In this case you could always push the changes to completion, and reason about whether each intermediate state is safe.