Separate saving from publishing
A common assumption is that an unreachable authorization service should block every save. That merges two decisions: keeping a private draft and changing shared state. Think of an author keeping a manuscript while an editor controls publication. Preserving permitted local work can remain useful while publication authority is uncertain.
A concrete counterexample
Consider a teammate revising an already open, nonsensitive project note when the network drops. Existing policy permits encrypted local drafts. If the editor then crashes, refusing local persistence loses the edits while leaving the shared copy unchanged. Instead, save locally, label the revision “local draft,” and pause synchronization. This example is illustrative, not a reported test result.
Check recovery and reconnection
Open a permitted note, disconnect from the authority service, edit it, and restart the application. Verify that the draft reopens and the shared copy stays unchanged. Also test exhausted storage: a failed write must never display “saved.”
After reconnection, validate the session, check current permissions, and fetch the latest shared version. Compare it with the version the draft started from, and reconcile overlapping changes. Have the server enforce both permission and the expected version when accepting an upload. If it refuses, retain the draft wherever local storage remains permitted.
Hypothetical boundary: permission expires
Hypothetical boundary case: a contractor edits a restricted document under a rule allowing local storage only until a specified offline deadline. The connection fails just before that deadline, so continued permission cannot be confirmed.
Decision rule: preserve the draft only while an explicit local-storage grant remains valid. At expiry, stop further local saves and enforce the grant’s retention policy. Warn before the deadline and offer only permitted export or renewal options. An outage cannot renew an expired grant. The useful principle is conditional: preserve authorized work locally, and require current authority before changing shared state.