Authorisation is much more cacheable than a value that inherently changes every single time you check it. Also authorisation revocation is relatively uncommon,

Authorisation is much more cacheable than a value that inherently changes every single time you check it. Also authorisation revocation is relatively uncommon, which means you can have a fast-path for approval, and then push only the revoked key IDs to just frontend servers.